Top Risks

• Uninstall and install URL hijacks redirect to yowgames.com with UTM tracking — monetization shell pattern.
• Privacy policy is a generic yowgames.com policy: admits data collection and 3rd-party sharing without scoping to this extension.
• Content script injected on every site (*://*/*) despite stated function being only a cursor change.
• Developer uses free Gmail address (uralsinem026@gmail.com); no verified publisher badge.
• No CSP declared; jquery 3.6.0 bundled (not patched to 3.7+) on an extension with broad content-script reach.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; classic monetization-shell redirect (+3.0 Webstore).
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params (+2.0 Webstore).
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• content_script_all_urls manifest content_scripts_matches=['*://*/*'] injects JS on every site; broad reach for cosmetic cursor extension.
• free_webmail_dev store Developer email uralsinem026@gmail.com; no verified publisher badge; Reputation floor ≥7.5.
• no_csp manifest content_security_policy=null; MV3 has strict default but no explicit CSP declared.
• jquery_3_6_0 crx jquery 3.6.0 bundled; no CVEs found in cve_findings_raw but below latest 3.7+ patch line.
• js_external_hosts crx Extension contacts chrome.google.com and yowgames.com externally.

Permissions Breakdown

• storage low Used to persist cursor selection; low standalone risk.
• content_scripts *://*/* high Content script runs on every page the user visits; broad reach for a cursor extension.

Pillar Scores

Bookkeeping