Top Risks

• Uninstall URL hijack to google.com redirect wrapping tabplugins.com — classic monetization shell behaviour.
• Install URL hijack opens tabplugins.com marketing page on every install.
• scripting + *://*/* host access allows JS injection on every site the user visits.
• Privacy policy admits data collection and third-party sharing without retention disclosure.
• Cursor-theme extension with broad host permissions is a scope mismatch; 300 installs + high perms is tail-attack-surface anomaly.

Evidence

• uninstall_url_hijack crx setUninstallURL targets google.com redirect wrapping tabplugins.com/cursors/ — monetization shell indicator.
• install_url_hijack crx onInstalled opens tabplugins.com/animal-crossing-cursor/?utm_source=google — traffic monetization.
• broad_host_access manifest host_permissions and content_scripts_matches both set to *://*/* on a cursor-theme extension.
• privacy_policy_deficiency store Policy fetched; data_collection=true, third_party_sharing=true, retention=false — inadequate disclosure.
• install_perm_anomaly api small_install_high_perm=true: 300 installs with HIGH-tier permission set.
• dom_sink_innerhtml crx innerHTML user-controlled sink in main.4964ab1e.js; no CSP present to mitigate DOM-XSS.
• no_developer_name store developer_name is empty string; verified_publisher=true but no 'Offered by' display name.
• low_rating store Rating 2.0 on a cursor theme extension; suggests user dissatisfaction.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• unlimitedStorage low Allows large local storage; minor resource concern.
• scripting high Combined with *://*/* host access, enables JS injection on every page.
• host_permissions: *://*/* high Broad access to all sites; dramatically amplifies scripting risk.
• content_scripts: *://*/* high Content scripts run on every page, expanding attack surface.

Pillar Scores

Bookkeeping