Top Risks

• Uninstall URL hijack redirects to yowgames.com with UTM tracking on every removal.
• Install URL hijack opens yowgames.com on installation — monetization shell pattern.
• Privacy policy is generic (yowgames.com), not scoped to this extension, yet admits data collection and 3rd-party sharing.
• Content scripts injected on *://*/* (all sites) despite being a simple cursor extension — disproportionate reach.
• Free-webmail developer (gmail) with no verified publisher identity; developer_domain resolves to unrelated game portal.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with utm_source=Uninstall; monetization signal.
• install_url_hijack manifest onInstalled opens yowgames.com with utm_source=install; install hijack confirmed.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic game-portal policy.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects on every URL; excessive for a cursor extension.
• free_webmail_developer store Developer email afraezgi4@gmail.com; no verified publisher badge; unrelated game-portal brand.
• jquery_3.6.0_bundled crx jquery 3.6.0 bundled; no CSP present (MV3 default strict but csp_present=false); no CVEs flagged in findings.
• no_csp_present manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• yowgames_external_host crx js_external_hosts includes yowgames.com — same domain as install/uninstall hijack target.

Permissions Breakdown

• storage low Used to save cursor preferences; minimal risk in isolation.
• content_scripts *://*/* high Injects scripts on every site the user visits; broad reach despite single declared permission.

Pillar Scores

Bookkeeping