Top Risks

• Uninstall URL hijack to yowgames.com — tracks user churn via UTM parameters on every removal.
• Install URL hijack to yowgames.com — opens 3rd-party page on install with campaign tracking.
• Privacy policy (yowgames.com) admits data collection and 3rd-party sharing but is not scoped to this extension.
• Free-webmail developer (gmail) with no verified publisher status and no business-domain identity.
• Content scripts injected on all URLs (*://*/*) giving page-level DOM access on every site visited.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets yowgames.com with UTM campaign tracking on removal.
• install_url_hijack crx onInstalled opens yowgames.com with UTM campaign tracking — 3rd-party redirect on install.
• privacy_policy_generic_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 D rule → +10.0.
• free_webmail_developer store Developer email afraezgi4@gmail.com — numbered alias on free webmail, no verified publisher.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects JS on every page despite single declared permission.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.
• webstore_uninstall_hijack_score store Uninstall URL hijack rule applies +3.0 to webstore pillar per rubric.
• install_url_hijack_score store Install URL hijack rule applies +2.0 to webstore pillar per rubric.

Permissions Breakdown

• storage low Used to persist cursor preference settings locally.
• content_scripts *://*/* medium Broad content script injection on all URLs; injects cursor overlay on every page visited.

Pillar Scores

Bookkeeping