Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Peppa Pig Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijacked to yowgames.com with UTM tracking — classic monetization shell pattern (+3.0).
• Install URL hijacked to yowgames.com — opens 3rd-party page on install (+2.0).
• Privacy policy is generic yowgames.com policy: scope_extension=false, admits data collection and 3rd-party sharing → +10.0 privacy.
• Free-webmail Gmail developer email with no verified publisher — low accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → yowgames.com with UTM params; monetization tracking on uninstall.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params; classic install-redirect monetization.
• privacy_policy_generic store Policy fetched from yowgames.com; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email busrakaraman256@gmail.com; no verified publisher; dev name 'wallpaperlive' mismatch.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects on every site despite cursor-only stated function.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.
• js_external_hosts crx Extension references chrome.google.com and yowgames.com as external JS hosts.
• low_installs_unrated store Only 470 installs, rating=0; tail-risk profile with monetization infrastructure already wired.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Peppa Pig Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 5.37 -> 7.87 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Used to persist cursor preference settings locally.
• content_scripts *://*/* high Content script injected on every page — broad reach despite low declared permissions.

Pillar Scores

Bookkeeping