Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — confirmed monetization/data-collection pattern.
• Install URL hijack opens yowgames.com on install — aggressive user-tracking on first run.
• Privacy policy (yowgames.com) admits data collection + third-party sharing but not scoped to this extension → Privacy pillar 10.0.
• Free-webmail developer (gunaysimge48@gmail.com) with no verified publisher badge — low accountability.
• Content script runs on *://* giving read access to every page the user visits.

Evidence

• uninstall_url_hijack crx setUninstallURL targets yowgames.com with UTM params — monetization/tracking on uninstall.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params — tracking on install event.
• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic site policy.
• free_webmail_developer store Developer email gunaysimge48@gmail.com; no verified publisher badge; developer_domain gmail.com.
• content_scripts_broad manifest content_scripts_matches: *://*/* — injected on all sites for cursor replacement.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• external_host_yowgames crx js_external_hosts includes yowgames.com — operator's own domain contacted at runtime.
• jquery_3_6_0_bundled crx jquery 3.6.0 detected; no CVEs found in cve_findings_raw for this version.

Permissions Breakdown

• storage low Used to persist cursor selection preference; low risk in isolation.
• content_scripts *://*/* medium Content script injected on every site; changes cursor appearance but reads full page DOM.

Pillar Scores

Bookkeeping