Top Risks

• Uninstall and install URL hijacks redirect users to yowgames.com with UTM tracking on every install/uninstall.
• Privacy policy not scoped to this extension; admits data collection and third-party sharing (generic yowgames policy).
• Content script injected on *://*/* gives DOM access to every site despite minimal declared permissions.
• Developer uses free Gmail address with no verified publisher status; developer domain identity unclear.
• No CSP defined (MV3 default applies, but no explicit policy); yowgames.com contacted as external JS host.

Evidence

• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — monetization shell pattern.
• uninstall_url_hijack manifest setUninstallURL points to yowgames.com with UTM tracking — webstore +3.0.
• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D-clause → +10.0 privacy.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects on every site.
• free_webmail_developer store Developer email afraezgi4@gmail.com; no verified publisher badge; reputation base elevated.
• js_external_host_yowgames crx yowgames.com listed as external JS host alongside chrome.google.com.
• jquery_3.6.0_bundled crx jquery 3.6.0 detected; no CVEs found in cve_findings_raw — no CVE score added.
• no_csp manifest content_security_policy is null; MV3 default applies, no explicit policy hardening.

Permissions Breakdown

• storage low Used to persist cursor preferences locally; minimal risk.
• content_scripts *://*/* high Content script runs on every site; broad DOM access despite no host_permissions declared.

Pillar Scores

Bookkeeping