Top Risks

• Uninstall URL hijack redirects to yowgames.com with UTM tracking — classic traffic-monetization pattern.
• Install URL hijack opens yowgames.com on installation — third-party redirect on onInstalled.
• Privacy policy (yowgames.com) is a generic site policy: scope_extension=false, admits data collection + third-party sharing.
• Free-webmail developer (gunaysimge48@gmail.com) with no verified business identity; no verified publisher badge.
• Content scripts injected on all URLs (*://*/*) despite cursor-only stated function; broad page access.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets https://yowgames.com/... with UTM params — Webstore +3.0.
• install_url_hijack manifest onInstalled opens https://yowgames.com/... with UTM params — Webstore +2.0.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0 (D-rule).
• free_webmail_dev store Developer email gunaysimge48@gmail.com; no verified publisher; no business site → Reputation +1.5.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects on every page; stated function is cursor only.
• js_external_host_yowgames crx Extension contacts yowgames.com externally; privacy policy domain matches install/uninstall hijack target.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• operator_cluster_singleton api sibling_count=0; no cross-extension cluster amplifier applied.

Permissions Breakdown

• storage low Used to persist cursor preference settings; low standalone risk.
• content_scripts *://*/* medium Scripts injected on every page; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping