Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Supercars Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijacks redirect users to yowgames.com with UTM tracking on every install/uninstall.
• Privacy policy not scoped to this extension; admits data collection and third-party sharing (generic yowgames policy).
• Content script injected on *://*/* gives DOM access to every site despite minimal declared permissions.
• Developer uses free Gmail address with no verified publisher status; developer domain identity unclear.

Evidence

• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — monetization shell pattern.
• uninstall_url_hijack manifest setUninstallURL points to yowgames.com with UTM tracking — webstore +3.0.
• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D-clause → +10.0 privacy.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects on every site.
• free_webmail_developer store Developer email afraezgi4@gmail.com; no verified publisher badge; reputation base elevated.
• js_external_host_yowgames crx yowgames.com listed as external JS host alongside chrome.google.com.
• jquery_3.6.0_bundled crx jquery 3.6.0 detected; no CVEs found in cve_findings_raw — no CVE score added.
• no_csp manifest content_security_policy is null; MV3 default applies, no explicit policy hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Supercars Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 5.04 -> 7.54 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Used to persist cursor preferences locally; minimal risk.
• content_scripts *://*/* high Content script runs on every site; broad DOM access despite no host_permissions declared.

Pillar Scores

Bookkeeping