Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Harry Potter Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack redirects to yowgames.com with UTM tracking — classic monetization shell pattern.
• Install URL hijack opens yowgames.com with UTM params on every install — traffic harvesting.
• Privacy policy (yowgames.com) admits data collection and third-party sharing but is NOT scoped to this extension.
• Developer email is free webmail (gmail) with no verified business identity; developer_domain info unavailable.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM tracking params.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM install tracking params.
• privacy_policy_scope_mismatch api Policy fetched from yowgames.com; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email gunaysimge48@gmail.com; no verified publisher badge; no business domain.
• content_scripts_broad crx content_scripts_matches includes *://*/* — runs on every page.
• low_rating store Rating 2.8 indicates user dissatisfaction.
• no_csp crx content_security_policy is null; csp_present=false on MV3 extension.
• external_host_yowgames crx js_external_hosts includes yowgames.com — operator-controlled domain used for traffic.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Harry Potter Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 4.59 -> 7.09 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preference data locally; low inherent risk.
• content_scripts *://*/* medium Runs on every page the user visits; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping