Top Risks

• Uninstall URL hijack sends user to yowgames.com with UTM tracking — traffic-monetization shell pattern.
• Install URL hijack opens yowgames.com on install — classic low-effort monetization fingerprint.
• Privacy policy is from yowgames.com, does NOT scope to this extension, yet admits data collection and third-party sharing → Privacy pillar 10.0.
• Developer is free-webmail (gmail) with no verified business; policy domain is a separate game portal unrelated to wallpaperlive dev name.
• description_promise.is_shell_pattern == true; content_scripts on *://*/* despite pure cursor-cosmetic stated function.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → yowgames.com with UTM params; +3.0 Webstore (monetization shell).
• install_url_hijack crx onInstalled opens yowgames.com with UTM params; +2.0 Webstore.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• free_webmail_developer store busrakaraman256@gmail.com; no verified publisher, no recognized org → Reputation floor 7.5.
• shell_pattern store description_promise.is_shell_pattern==true; content_scripts on *://*/* for cursor-only extension.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] gives reach across all sites with no host_permissions declared.
• maintenance_3_6mo store 9 months since update → Maintenance +3.5.
• no_csp manifest csp_present=false on MV3; no additional network penalty (MV3 default strict), but amplifies other risks.

Permissions Breakdown

• storage low Used to persist cursor preference. Low standalone risk.
• content_scripts *://*/* medium Runs on every page visited; broad reach even with narrow declared function.

Pillar Scores

Bookkeeping