Top Risks

• Uninstall and install URL hijack redirect users to tabplugins.com ad/tracking pages — monetization shell pattern.
• Broad *://*/* host + content_scripts runs on every site with innerHTML DOM-XSS sink and no CSP.
• Privacy policy admits third-party data sharing but no retention period — inadequate for broad host extension.
• Low-install (935) extension with HIGH-tier permissions is a tail-attack-surface anomaly.
• No CSP on MV3 with DOM sink and scripting on all URLs amplifies XSS risk.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both onInstalled and uninstall callbacks redirect to tabplugins.com with UTM tracking — monetization shell pattern.
• broad host permissions + content_scripts manifest host_permissions and content_scripts_matches both *://*/* — runs on every page visited.
• dom_sink_innerhtml_userctrl crx innerHTML assignment in main.4964ab1e.js; no CSP present, raising DOM-XSS risk.
• csp_present == false manifest content_security_policy is null; MV3 default CSP applies but no extension-level hardening.
• privacy_policy third_party_sharing + no retention store Policy fetched, scoped to extension, collects data and shares with third parties but no retention period stated.
• install_perm_anomaly.small_install_high_perm api 935 installs with HIGH-tier host permission (*://*/*) — tail attack surface flag.
• unverified publisher + no featured badge store verified_publisher=false, is_featured_by_google=false; no accountability signals.
• js_external_hosts include reactjs.org crx reactjs.org referenced in JS — external host reference beyond dev's own domain.

Permissions Breakdown

• storage low Stores cursor preference settings locally; low risk.
• unlimitedStorage low Extends storage quota; minor risk for cursor assets.
• scripting medium Allows programmatic script injection into pages; medium risk.
• *://*/* (host_permissions) high Full cross-origin host access on all URLs; broad attack surface for a cursor extension.
• *://*/* (content_scripts_matches) high Content script runs on every page, compounding broad host permission risk.

Pillar Scores

Bookkeeping