Top Risks

• Brand impersonation: uses 'Minecraft' and 'Chrome™' marks; developer not confirmed owner, gmail account
• Uninstall AND install URL hijack to yowgames.com landing page with UTM tracking (traffic-monetization pattern)
• Generic privacy policy admits data collection and 3rd-party sharing without scoping to this extension
• Content script injected on every site (*://*/*) though only cosmetic function is claimed
• Free-webmail dev with no business identity; 10 months since last update

Evidence

• install_uninstall_hijack crx Both onInstalled and setUninstallURL open yowgames.com promo page with utm_campaign tracking params.
• brand_impersonation api brand_mention.is_impersonation=true for 'minecraft'; dev domain gmail.com, confirmed_owner=false.
• privacy_policy_generic api Policy fetched but scope_extension=false with data_collection=true and third_party_sharing=true (+10 privacy).
• broad_content_script manifest content_scripts matches *://*/* for a cosmetic cursor extension; storage is only declared permission.
• dev_identity store Free gmail dev (servetyahya06), no developer name; verified_publisher=true but capped by stale/monetz signals.
• stale_update store Last updated Dec 2025, ~10 months ago; rating 3.3; only 3,000 installs.
• no_csp_mv3 crx csp_present=false but MV3 strict default applies; no +2 penalty per rule (b). jquery 3.6.0 bundled, no CSP combo at 3.6.
• clean_code_scan crx code_findings_raw empty, obfuscation 0.0, single external host yowgames.com; no CVEs flagged.

Permissions Breakdown

• storage low Stores cursor settings locally; minimal risk surface.

Pillar Scores

Bookkeeping