Top Risks

• Uninstall URL hijack: redirects to yowgames.com affiliate/UTM URL on removal — monetization shell pattern.
• Install URL hijack: opens yowgames.com UTM URL on install — unsolicited navigation on first run.
• Privacy policy fetch failed (SSLError); third_party_silence=true; no verifiable data-handling disclosure.
• Free-webmail developer (gmail) with no verified business; privacy policy domain (yowgames.com) doesn't match dev email.
• Content scripts injected on *://*/* (all sites) with no CSP, run as fan-theme shell.

Evidence

• uninstall_url_hijack crx setUninstallURL → yowgames.com with UTM params; classic monetization shell signal (+3.0 Webstore).
• install_url_hijack crx onInstalled opens yowgames.com UTM URL; unsolicited 3rd-party navigation on first run (+2.0 Webstore).
• privacy_policy_fetch_failed api SSLError on yowgames.com/privacy-policy; fetched==false → Privacy pillar +10.0.
• free_webmail_dev store ayseozkacar237@gmail.com — numbered alias pattern, no verified business; Reputation floor applies.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects into every page; broad reach for cursor-only function.
• no_csp manifest content_security_policy=null on MV3; no runtime CSP protection for injected scripts.
• jquery_3_6_0_bundled crx jQuery 3.6.0 detected; no CVEs in cve_findings_raw, no CVE pillar penalty.
• fan_content_shell_pattern store Anime-fan cursor theme with install/uninstall UTM hijack and mismatched dev email vs policy domain.

Permissions Breakdown

• storage low Stores cursor preference settings locally; expected for this category.
• content_scripts *://*/* high Injects JS into every page the user visits; broad reach for a cursor extension.

Pillar Scores

Bookkeeping