Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — classic monetization shell pattern.
• Install URL hijack to yowgames.com with UTM tracking on extension install.
• Privacy policy is a generic yowgames.com policy: admits data collection + 3rd-party sharing, not scoped to this extension → scored +10.0.
• Free-webmail developer (gunaysimge48@gmail.com) with no verified publisher or business identity.
• Content script injected on *://*/* gives reach into every page visited despite low declared permissions.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://yowgames.com/haikyuu-cursor-...?utm_source=Uninstall — 3rd-party redirect on uninstall.
• install_url_hijack crx onInstalled opens https://yowgames.com/haikyuu-cursor-...?utm_source=install — monetization redirect on install.
• privacy_policy_generic store Policy at yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy pillar (v3.5 rule D).
• free_webmail_developer store Developer email gunaysimge48@gmail.com; no verified publisher, no business domain identity.
• content_script_all_urls manifest content_scripts_matches=['*://*/*'] — runs on every HTTP/HTTPS page.
• webstore_monetization_shell store Both install and uninstall hijack to yowgames.com with UTM params = low-effort traffic-monetization pattern.
• jquery_3_6_0_bundled crx jquery@3.6.0 detected; no CVEs found in cve_findings_raw. No CSP present but no eval/code findings to trigger amplifier.
• no_csp manifest content_security_policy is null (MV3 strict default applies; no v2 +2.0 network penalty).

Permissions Breakdown

• storage low Stores cursor preferences locally; expected for this category.
• content_scripts *://*/* high Injects JS/CSS into every page the user visits — broad reach for a cursor tool.

Pillar Scores

Bookkeeping