Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Super Mario Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to yowgames.com with UTM tracking — monetization shell pattern.
• Install URL hijack to yowgames.com — drives traffic on every install event.
• Privacy policy fetched but scoped to yowgames.com site, not this extension; admits data collection and 3rd-party sharing → +10.0 privacy.
• Free-webmail developer (gmail) with no verified business identity; dev name 'live4kwallpaper' unverifiable.

Evidence

• uninstall_url_hijack crx setUninstallURL → yowgames.com with UTM params; classic monetization-shell uninstall hijack (+3.0 webstore).
• install_url_hijack crx onInstalled opens yowgames.com with UTM params; drives affiliate/ad traffic on install (+2.0 webstore).
• privacy_policy_not_scoped store Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0 (D rule).
• free_webmail_developer store Developer email ayseozkacar237@gmail.com; no verified publisher; no recognized org; reputation penalty applies.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects into every site; broad reach with no host_permissions declared separately.
• external_js_host_yowgames crx js_external_hosts includes yowgames.com; unknown third-party domain controlling code loaded by extension.
• maintenance_6_12mo store months_since_update=9; falls in 6-12mo band → +3.5 maintenance.
• no_csp manifest content_security_policy=null (csp_present=false); MV3 default applies but no explicit hardening declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Super Mario Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 4.73 -> 7.23 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preferences locally; low risk in isolation.
• content_scripts *://*/* medium Injects JS into every page visited; broad reach even without host_permissions declared.

Pillar Scores

Bookkeeping