Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Chiikawa Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to yowgames.com with UTM tracking — classic traffic-monetization shell pattern.
• Install URL hijack to yowgames.com — opens 3rd-party page on every install.
• Privacy policy on yowgames.com admits data collection and third-party sharing but is NOT scoped to this extension.
• Free-webmail developer (gmail) with no verified publisher badge — no accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() → yowgames.com with UTM params; monetization shell indicator.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params; traffic-monetization pattern.
• privacy_policy_mismatch api Policy fetched from yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email afraezgi4@gmail.com; no verified publisher; developer_domain gmail.com.
• content_scripts_all_urls manifest content_scripts_matches=['*://*/*'] injects into every site; high reach.
• no_csp crx content_security_policy is null; MV3 strict default applies but no explicit CSP set.
• js_external_hosts crx External JS hosts: chrome.google.com, yowgames.com — yowgames is developer affiliate domain.
• maintenance_6_to_12_months store Last updated November 2025; months_since_update=9; moderate staleness.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Chiikawa Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 4.89 -> 7.39 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Used to persist cursor preferences; low standalone risk.
• content_scripts *://*/* high Injects JS into every page the user visits; broad reach despite narrow declared permissions.

Pillar Scores

Bookkeeping