Blue Lock Cursor ★ Custom Cursor for Chrome™

On install the extension immediately opens a new tab to a third-party domain (yowgames.com) with UTM tracking parameters that uniquely identify install events. Combined with setUninstallURL pointing to the same domain, the operator receives a server-side ping for every install and uninstall, enabling user-count tracking and potential re-engagement campaigns without any disclosure to the user.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason === "install") {    chrome.storage.local.set({      switch_status: "true",      default_cursor: "",      pointer_cursor: "",      default_cursor_result: "",      pointer_cursor_result: "",      default_curSize: "48",      pointer_curSize: "48",      favorites: []    });    // Kurulum sonrası hoş geldiniz sayfasını aç    chrome.tabs.create({      url: "https://yowgames.com/blue-lock-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install"    });  }});// Uzantı kaldırıldığında çalışacakchrome.runtime.setUninstallURL(  "https://yowgames.com/blue-lock-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=Uninstall&utm_medium=link&utm_campaign=bg&utm_content=Uninstall");

The content script is declared with run_at: document_start and all_frames: true matching every URL including sensitive sites (banking, email, password managers). Executing at document_start means the script runs before any page content is parsed or rendered, giving it the earliest possible window to intercept or manipulate page state including form fields and credentials. The all_frames flag extends this to every nested iframe on every page.

{  "content_scripts": [    {      "all_frames": true,      "js": [        "cursorcontent.js"      ],      "matches": [        "*://*/*"      ],      "run_at": "document_start"    }  ]}

A MutationObserver is attached to document.documentElement with subtree: true, monitoring the entire DOM tree of every visited page for iframe and frame additions. While the stated purpose is to re-apply cursor styling in new frames, this persistent observer running on all pages could be repurposed in a future update to exfiltrate data from dynamically injected iframes (e.g. payment overlays, auth dialogs).

// Sayfadaki dinamik değişiklikleri izle ve cursor'u tekrar uygulaconst observer = new MutationObserver(function(mutations) {  // Sadece önemli DOM değişikliklerinde cursor'u tekrar uygula  if (mutations.some(mutation =>      mutation.type === 'childList' &&      (mutation.addedNodes.length > 0 || mutation.removedNodes.length > 0) &&      Array.from(mutation.addedNodes)      .some(node => node.nodeName === 'IFRAME' || node.nodeName === 'FRAME')    )) {    if (cursorData) {      applyCursor(cursorData);    }  }});// DOM değişikliklerini izlemeye başlaobserver.observe(document.documentElement, {  childList: true,  subtree: true});

The popup page loads a Google Fonts stylesheet from an external CDN at popup-open time, causing the browser to make an outbound HTTP request to fonts.googleapis.com every time the user opens the extension popup. This leaks the fact that the extension is active on a given browser instance to Google and the operator can infer popup activity via referrer or timing.

<link href="https://fonts.googleapis.com/css2?family=Nunito:wght@400;600;700&display=swap" rel="stylesheet">

The 'Get More Cursors' button in the popup navigates to a third-party domain (yowgames.com) with UTM parameters that identify the specific click event and campaign. This is an affiliate/referral monetization mechanism embedded in the extension UI that sends behavioral signals (user clicked the upsell button) to an external operator-controlled domain.

<a href="https://yowgames.com/blue-lock-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=getcursors&utm_medium=link&utm_campaign=bg&utm_content=getcursors"  class="action-btn pink" target="_blank"> Get More Cursors < /a>