Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Amazing Custom Cursor

CRITICAL RISKRemoved from Chrome Web Store

Amazing Custom Cursor

ID: cnmlhlejmndckempfickgoelmkjfpece

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.2.1

Size

1.49 MB

Rating

3.3/5

Reviews

Users

534,966

Type

Extension

Updated

Nov 13, 2020

Publisher Contextual Analysis

Author: Julie JuradoView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

534,966

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Amazing Custom Cursor - change mouse cursor style from 100+ presets

Amazing Custom Cursor allows you to change cursor style to themed preset cursors or upload custom cursor. * Features * - Change cursor on any page to one of our 100+ presets 👉 - Several preset categories 🌞 - Upload a custom cursor ⚙️ * How to use * - Install the extension - Click on toolbar button - Select “Upload cursor” to add your own custom cursor Please note that due to security limitations cursor could not be changed on internal browser pages or in Chrome Webstore.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High1

Medium1

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.1 Code review	2
1.2 Code review	3

Extension Version	Code Review Findings
1.2.1	2
1.2	3

Files with findings

1 distinct path — top paths by unique finding count:

background.js5

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	background.js (line 216)	The `get_config` action dumps the entire `chrome.storage.local` contents to any requesting external origin with no authentication or origin check. The `set_config` and `set_config_sync` actions allow any website to wr…	1.2
2	Remote Code Loading	critical	background.js (line 7)	The background page dynamically replaces a local script element with a remotely hosted Google Tag Manager script. In a Manifest V2 extension, remote script execution in the extension context is a critical pattern beca…	1.2.1
3	Unauthorized Data Collection	critical	background.js (line 163)	The `onMessageExternal` listener has zero origin validation — any website can send messages to this extension by knowing (or enumerating) its ID. The `install_collection` and `install_pack` handlers blindly accept and…	1.2
4	Privilege Escalation	high	background.js (line 237)	This external message handler exposes full read/write access to both local and sync storage without validating `sender.id` or any trusted origin. That gives other extensions/apps a direct control channel to fingerprin…	1.2.1
5	Tracking	medium	background.js (line 238)	The `authSync` method runs every 10 seconds indefinitely and continuously overwrites `chrome.storage.sync` with the full set of cursor pack IDs and the user's size preference. Chrome Sync storage is tied to the user's…	1.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.googletagmanager.com	/gtm.js	https://www.googletagmanager.com/gtm.js?id=GTM-5H7LFK9&l=dl
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
goo.gl	/pxwQGp	https://goo.gl/pxwQGp
popper.js.org	-	https://popper.js.org
github.com	/twbs/bootstrap/issues/24251	https://github.com/twbs/bootstrap/issues/24251
www.quirksmode.org	/blog/archives/2014/02/mouse_event_bub.html	https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
jquery.com	-	http://jquery.com/
sizzlejs.com	-	http://sizzlejs.com/
jquery.org	/license	http://jquery.org/license
jsperf.com	/thor-indexof-vs-for/5	http://jsperf.com/thor-indexof-vs-for/5

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

nao da pra mudar para padrao

#.xxDEIDARAxx.#·18 Feb 2021

it is dumb stupid and a waste of your time

visionpotato519·12 Feb 2021

it was useless when the cursors are bad and when i tried to get rid of it it wouldn't let me I stg I hate this

Gacha Hater·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Amazing Custom Cursor

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews