Top Risks

• Uninstall URL hijack to tabplugins.com — classic low-effort traffic-monetization shell pattern (+3.0 webstore).
• Install URL hijack to tabplugins.com — onInstalled opens 3rd-party URL (+2.0 webstore).
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worse than no policy (+10.0 privacy).
• Free-webmail dev (gmail) with no developer name and no business website — unverifiable identity (+reputation floor).
• scripting + *://*/* allows script injection into every site user visits; no CSP present.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://tabplugins.com/cursors/ — 3rd-party monetization redirect.
• install_url_hijack manifest onInstalled opens https://tabplugins.com/fnaf-cursor-custom-horror-cursor-for-chrome/ — 3rd-party.
• privacy_policy_generic store Policy is Google's account policy: scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Dev email mbilalshah0001@gmail.com; developer_name empty; no business domain.
• broad_host_with_scripting manifest scripting + *://*/* on MV3 without CSP; can inject into any page.
• dom_sink_innerhtml_userctrl crx innerHTML assignment from variable in main.4964ab1e.js — DOM-XSS sink.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction.
• verified_publisher_cap store verified_publisher=true but free-webmail dev, no domain; discount capped per 0c (monetization shell signals).

Permissions Breakdown

• storage low Stores cursor preferences locally; low standalone risk.
• unlimitedStorage low Extends storage quota; minimal risk for a cursor extension.
• scripting high Paired with *://*/* host access: can inject scripts into any page.
• *://*/* high Broad host access covering all URLs; amplifies scripting risk.

Pillar Scores

Bookkeeping