Top Risks

• Gmail developer account (blife450@gmail.com) with no verified business identity raises accountability concerns.
• Content scripts injected into <all_urls> — every page visited is in scope for the extension.
• Privacy policy fetch failed; data handling completely unverifiable despite 5M installs.
• install_url and uninstall_url redirect to custom-cursor.com with UTM tracking parameters.
• innerHTML DOM sink + new Function() constructor present; no CSP to mitigate XSS risk on all pages.

Evidence

• host_permission_all_urls manifest <all_urls> host permission + content_scripts on <all_urls>; scripting on all pages.
• gmail_developer store Developer email blife450@gmail.com — free webmail, no verified business entity.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false (HTTPError); policy content unverifiable.
• install_url_hijack crx onInstalled opens https://custom-cursor.com/successful-installation with UTM params.
• uninstall_url_hijack crx setUninstallURL points to https://custom-cursor.com/uninstall with UTM params.
• code_findings_function_constructor_innerHTML crx new Function() in popup.min.js & content.js; innerHTML DOM sink in popup.min.js; no CSP.
• verified_publisher_featured store Extension is verified publisher AND featured by Google; partially offsets reputation concerns.
• js_external_hosts crx External JS hosts: custom-cursor.com, fb.me, github.com, reactjs.org (3 countries).

Permissions Breakdown

• scripting medium Can inject JS into pages; paired with <all_urls> host permission this is high-reach.
• storage low Stores extension settings locally.
• unlimitedStorage low Allows unbounded local storage; minor abuse potential.
• notifications low Can show desktop notifications; low direct risk.
• alarms low Schedules background tasks; low risk alone.
• <all_urls> (host_permission) high Content scripts injected into every page the user visits; broad attack surface.

Pillar Scores

Bookkeeping