Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Anime Cursor - Custom Cursor for Chrome™ - All in One Anime Cursors [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Broad host_permissions (*://*/*) + scripting allows content injection on every visited site.
• Uninstall and install URL hijack redirect users to developer's marketing page.
• innerHTML DOM-XSS sink in bundled JS (no CSP to mitigate) — exploitation surface if cursor data is attacker-controlled.
• Developer name missing from listing despite verified publisher badge — accountability gap.

Evidence

• broad_host_permissions manifest host_permissions and content_scripts_matches both set to *://*/* — runs on every page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com marketing page with UTM params.
• install_url_hijack crx onInstalled opens gameograf.com marketing page with UTM params.
• dom_sink_innerhtml crx Two JS files contain unguarded innerHTML assignments; no CSP to limit exploitation.
• verified_publisher_featured store Extension carries both verified_publisher and is_featured_by_google badges — reputation discounts applied.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• no_developer_name store developer_name field is empty despite verified publisher status.
• js_external_hosts crx Contacts api.gameograf.com, gameograf.com, chrome.google.com, reactjs.org — 4 distinct domains.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Anime Cursor - Custom Cursor for Chrome™ - All in One Anime Cursors [adware] + malext.io malicious_extension_sentry; score 2.91 -> 5.41 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores user cursor preferences locally; low risk.
• scripting medium Allows programmatic script injection into pages; elevated risk with broad host access.
• *://*/*HostPermission high Broad host access to all URLs; enables content injection on every site visited.

Pillar Scores

Bookkeeping