Cursorly

The bundled manifest (MV3) declares only `storage` under permissions and moves `*://*/*` to `host_permissions`, omitting both `tabs` and `notifications` that appear in the live CWS MV2 listing. Per review policy, any mismatch between bundled and published permissions is a required finding. The most plausible explanation is a legitimate MV2→MV3 migration (Chrome MV3 no longer requires `tabs` for `chrome.tabs.create` in popups, and no notification code was found in the bundle), but this cannot be verified without the publisher's release notes.

{  "manifest_version": 3,  "permissions": ["storage"],  "host_permissions": ["*://*/*"],  ...}// vs. published MV2 listing:// "permissions": ["storage", "tabs", "*://*/*", "notifications"]

The `onMessageExternal` handler's `"set"` case passes `e.data` directly to `chrome.storage.local.set()` without any key allowlist, letting any page on cutecursors.com write arbitrary key-value pairs to the extension's local storage. While `externally_connectable` restricts callers to `*://*.cutecursors.com/*` and the stored values are used only for cursor display settings (making code-injection via storage impossible in the current codebase), a compromised or XSS-afflicted cutecursors.com page could push unexpected configuration. The `"getConfig"` case additionally returns all extension storage — including installation date, favorites, and cursor preferences — to the requesting page.

chrome.runtime.onMessageExternal.addListener((function(e, t, r) {  switch (e.action) {    case "set":      chrome.storage.local.set(e.data), r({        action: "saveData"      });      break;    case "getConfig":      return chrome.storage.local.get(null, (function(e) {        r(e)      })), !0;    case "changecursor":      ...  }}))