Security Warning: Historically Flagged as Malware
This extension is historically labeled as malware, but the current version analysis does not yet confirm severe malicious findings.Extension: Custom Cursor for Chrome
HIGH RISKStill available - needs review
Custom Cursor for Chrome
ID: phfkifnjcmdcmljnnablahicoabkokbg
Supported Languages
🇧🇷Brazilian Portuguese
🇬🇧British English
🇪🇸Catalan
🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇳🇱Dutch
🇺🇸English
🇫🇮Finnish
🇫🇷French
🇩🇪German
🇮🇹Italian
🇯🇵Japanese
🇰🇷Korean
🇲🇽Latin American Spanish
🇳🇴Norwegian
🇵🇱Polish
🇵🇹Portuguese
🇪🇸Spanish
🇸🇪Swedish
🇺🇸US English
Extension Info & Metadata
Status
Active
Version
2.0.13
Size
1.02 MB
Rating
4.4/5
Reviews
5,000
Users
800,000
Type
Extension
Updated
Aug 7, 2025
Category
Just for fun
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Publisher Contextual Analysis
Trusted
- Author
- cursorstore.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
800,000
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Enhance your Chrome experience with custom cursor. Give your mouse cursor a unique touch by replacing it with a custom cursor.
It's such a cute custom cursors for Chrome. Show your individuality with the bright and gorgeous mouse pointer on every webpage. Forget about the boring and simple cursor that has many years to appear on the display. Now you are able to change your mouse pointer to something pink and cute ;) Forget the boring default mouse pointer, because now it can be something more! Something to inspire you, cheer you up and just make you happy. We're the Cute Cursors crew and we've made it our mission to pimp your cursor! We have breathed even more life into our mouse cursors. And so much so that now they have become alive. They shimmer in colors, move, spin, dance, and most importantly give even more expression and positive emotions. Custom cute cursors is a great extension for Chrome that lets you change your browsing experience by creating your own mouse pointers. With the library of this extension, you can find anything to suit your style, whether it's a set of animal symbols or something else entirely. Change your cursor now and get ready for an awesome experience! 5 reasons why you should install the Custom Cursors for Chrome extension: 1. Personalization - extension Custom Cursors for Chrome allows you to personalize your browsing experience by giving your mouse pointer a unique look. 2. Aesthetics - If you're someone who likes to pay attention to the little details, then this extension is perfect for you. Customized cursors can add a touch of aesthetic appeal to your browsing experience. 3. Easy to use - extension Custom Cursors for Chrome is incredibly easy to use. Simply install the extension and select your preferred cursor design. There's no technical knowledge required to use the extension. 4. Fun - Custom Cursors for Chrome can add a fun element to your browsing experience. With a variety of creative cursor designs available, you can swap out your mouse pointer design whenever you like to keep things interesting. 5. Improved visibility - If you struggle to see the default mouse cursor on your screen, then changing it to a customized design could improve your visibility. The increased visibility of a custom cursor can help you keep track of your mouse movements more easily. Attention! Make sure you use the Cute Cursors extension on any web page other than the Chrome Web Store, Google internal pages, and the Chrome home page, as Google policy prohibits the use of custom cursors on these pages.
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical13
High30
Medium62
Low17
Versions scanned
Showing 16 of 16 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.0.13 | 8 |
| 2.0.12 | 10 |
| 2.0.11 | 8 |
| 2.0.10 | 8 |
| 2.0.9 | 9 |
| 2.0.8 | 4 |
| 2.0.7 | 8 |
| 2.0.6 | 8 |
| 2.0.5 | 8 |
| 2.0.4 | 10 |
| 2.0.2 | 7 |
| 2.0.1 | 7 |
| 2.0.0 | 7 |
| 1.0.2 | 7 |
| 1.0.1 | 6 |
| 1.0.0 | 7 |
Files with findings
8 distinct paths — top paths by unique finding count:
- background.js66
- js/background.js19
- resources/js/main.js14
- manifest.json10
- content_site.js6
- cursor-injector.js3
- resources/js/custom.js3
- js/content_site.js1
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Obfuscation | critical | background.js (line 4889) | Uses a rotating string-array obfuscation technique (a well-known pattern from js-confuser/obfuscator.io) to conceal a `chrome.runtime.onInstalled` listener. The obfuscated fragments decode to: fetch `https://cursorsto… | |
| 2 | Remote Code Loading | critical | background.js (line 5428) | The newFeatures handler opens any URL returned by the remote server in a new tab, provided it starts with 'http'. This gives the remote server (r.cursorstore.com) the ability to redirect 800K users to any URL — includ… | |
| 3 | Remote Code Loading | critical | background.js (line 5014) | The response from the 'wi/' tracking endpoint is parsed as JSON, and if it contains a 'newfeatures' field starting with 'http', the extension opens that URL in a new tab. This is a remote code/content loading vector —… | |
| 4 | Remote Code Loading | critical | background.js (line 4963) | Sends user tracking data (extension ID, version, generated UID, timestamp, action type) to a remote PHP endpoint (cursorstore.com/action/index.php) as a base64-encoded payload. The server response can instruct the ext… | |
| 5 | Remote Code Loading | critical | background.js (line 4985) | Periodically fetches remote configuration from cursorstore.com/config/index.php, sending user fingerprint data (UID, extension ID, version, timestamp). The server response is blindly merged into the local config objec… | |
| 6 | Remote Code Loading | critical | background.js (line 4985) | The remote config update blindly copies ALL properties from the server response into the local config object (for-in loop with no filtering). This means the remote server can inject arbitrary configuration keys that c… | |
| 7 | Remote Code Loading | critical | js/background.js (line 5367) | After sending tracking data to the remote server, the response can contain an arbitrary URL which the extension will open in a new tab via chrome.tabs.create. This is a server-controlled redirect mechanism — the remot… | |
| 8 | Remote Code Loading | critical | js/background.js (line 5367) | On every install/update event, the extension sends a base64-encoded tracking payload to a remote server containing a persistent user ID. The server response can include an arbitrary URL that the extension will automat… | |
| 9 | Remote Code Loading | critical | js/background.js (line 13) | The processQueue method POSTs a base64-encoded payload to `https://cursorstore.com/api/action/index.php` containing the extension ID, version, a persistent user UID, and timestamp. It then parses the JSON response and… | |
| 10 | Remote Code Loading | critical | resources/js/main.js (line 1) | The background script phones home to cutecursore.com/api/action/ with base64-encoded telemetry (extension ID, version, unique user ID, timestamp). The server response can command the browser to open arbitrary URLs via… | |
| 11 | Remote Code Loading | critical | resources/js/main.js (line 1) | The background script phones home to https://cutecursore.com/api/action/ on every install/update event, sending a base64-encoded JSON payload containing the extension ID, version, a persistent UID, and timestamp. Crit… | |
| 12 | Remote Code Loading | critical | resources/js/main.js (line 1) | The background script sends base64-encoded telemetry (extension ID, version, generated UID, timestamp) to cursorstore.com/api/action/ on every install/update event. Critically, the server response can contain an arbit… | |
| 13 | Tracking | critical | background.js (line 4963) | The action queue processor sends user tracking data (uid, extension ID, version, timestamp) to cursorstore.com/action/index.php on install/update events. Critically, if the server responds with a 'url' field, the exte… | |
| 14 | Code Injection | high | background.js (line 4972) | On install, the extension enumerates ALL open tabs and programmatically injects scripts into every valid HTTP/HTTPS tab using chrome.scripting.executeScript. This is an aggressive injection pattern that immediately ga… | |
| 15 | Code Injection | high | background.js (line 5095) | On install, the extension iterates over ALL open tabs and injects content scripts (cursor-injector.js) into every tab matching http/https URLs using chrome.scripting.executeScript. This is aggressive injection into al… | |
| 16 | Code Injection | high | js/background.js (line 5405) | On install, the extension enumerates ALL open tabs and injects content.js into every tab matching HTTP/HTTPS URLs. The matchUrl function (line 5195) accepts all http:// and https:// pages. Combined with the <all_urls>… | |
| 17 | Code Injection | high | js/background.js (line 13) | On install, the extension enumerates every currently open tab via `chrome.tabs.query({})` and programmatically injects `content.js` into all HTTP/HTTPS tabs — exceeding what is necessary or what the declarative `conte… | |
| 18 | Code Injection | high | resources/js/custom.js (line 1) | Injects a hidden iframe into every page the user visits. The iframe has no src attribute set in this code, but since it's a web-accessible resource loaded as a content script, it could be used as a conduit for injecti… | |
| 19 | Code Injection | high | resources/js/custom.js (line 1) | Injects a hidden iframe into every page the user visits (this file is web-accessible and could be loaded by the content script context). A cursor-changing extension has zero legitimate reason to inject iframes. While … | |
| 20 | Code Injection | high | resources/js/custom.js (line 1) | Creates and injects a hidden iframe into every page (this file is in web_accessible_resources). The iframe has no src attribute set in the code, but could be used as a vehicle for content injection or tracking. The im… | |
| 21 | Privilege Escalation | high | manifest.json (line 18) | The cursor-injector content script runs on ALL URLs, in ALL frames, at document_start. This is the most aggressive injection configuration possible — the script executes before the page loads on every page the user vi… | |
| 22 | Privilege Escalation | high | manifest.json (line 18) | The cursor-injector.js content script runs on ALL URLs, in ALL frames (including iframes), at document_start — the earliest possible injection point. This gives the extension maximum reach to modify page content befor… | |
| 23 | Privilege Escalation | high | background.js (line 4986) | The open_link message handler navigates the current active tab to any URL provided in the message. Since content_site.js on cursorstore.com can send this message, the website can redirect any user's active tab to an a… | |
| 24 | Privilege Escalation | high | background.js (line 5014) | The background service worker handles `open_link` messages and calls `chrome.tabs.update` with the message's `link` property directly, with no validation of the sender (`t` — the `MessageSender` object) and no URL san… | |
| 25 | Privilege Escalation | high | manifest.json (line 18) | The extension injects cursor-injector.js into ALL URLs on ALL frames at document_start. Combined with <all_urls> host permissions, this gives the extension access to every page the user visits, including sensitive pag… | |
| 26 | Privilege Escalation | high | background.js (line 4986) | The 'open_link' message handler navigates the user's active tab to any arbitrary URL received via chrome.runtime message. Any content script (running on cursorstore.com) or the popup can trigger this without URL valid… | |
| 27 | Privilege Escalation | high | manifest.json (line 18) | The extension injects cursor-injector.js into every single page the user visits via <all_urls> content script matching combined with <all_urls> host permissions. For a cursor customization extension, this is overly br… | |
| 28 | Privilege Escalation | high | background.js (line 5109) | Handles an 'open_link' message that navigates the user's active tab to any URL provided in the message payload (e.link) without validation. Since content_site.js runs on cursorstore.com, the website can send messages … | |
| 29 | Privilege Escalation | high | background.js (line 5111) | The open_link message handler navigates the user's current active tab to any arbitrary URL received via chrome.runtime messaging, with no URL validation or sanitization. Any content script or the popup can trigger arb… | |
| 30 | Privilege Escalation | high | js/background.js (line 13) | The `open_link` message handler unconditionally redirects the user's active tab to `t.link` — any URL provided in the message — without validating the sender's origin or sanitising the URL. Since content scripts injec… | |
| 31 | Privilege Escalation | high | manifest.json (line 30) | The manifest declares http://*/* and https://*/* host permissions alongside the tabs permission, granting the extension ability to read tab URLs and inject scripts into any website. The CSP whitelists ssl.google-analy… | |
| 32 | Privilege Escalation | high | manifest.json (line 18) | The extension requests http://*/* and https://*/* host permissions plus tabs permission, giving it access to URLs and content of all tabs. Combined with <all_urls> content script injection and broad web_accessible_res… | |
| 33 | Remote Code Loading | high | background.js (line 5396) | On install/update, the extension fetches from a dynamically constructed URL (r.cursorstore.com/wi/?r=install) and passes the JSON response directly to the newFeatures handler. The URL is obfuscated via string replacem… | |
| 34 | Remote Code Loading | high | background.js (line 5428) | The remote server response from the /wi/ endpoint can trigger automatic tab opening to any arbitrary HTTP URL. This is a server-controlled redirect mechanism — the cursorstore.com backend can force any URL to open in … | |
| 35 | Remote Code Loading | high | background.js (line 5013) | The newFeatures handler opens any URL returned by the remote server in a new tab, as long as it starts with 'http'. This allows the cursorstore.com server to remotely direct users to arbitrary web pages on install/upd… | |
| 36 | Remote Code Loading | high | background.js (line 4953) | The extension fetches remote configuration from cursorstore.com/config/index.php on a recurring alarm-based schedule, sending the extension ID, version, timestamp, and a persistent user tracking ID. The server respons… | |
| 37 | Tracking | high | background.js (line 5012) | Sets up a recurring alarm to periodically phone home to the remote config server. The polling interval is controlled by the server-provided 'configUpTime' value, meaning the server can increase or decrease how frequen… | |
| 38 | Tracking | high | background.js (line 4953) | On startup, generates and persists a unique user ID (if not already set) and immediately begins contacting three remote PHP endpoints: action, uninstall, and config. This user fingerprinting combined with remote phone… | |
| 39 | Tracking | high | js/background.js (line 5354) | The background script phones home to cursorstore.com/api/action/index.php on every install/update event, sending the extension ID, version, a persistent user tracking ID (uid), and timestamp as base64-encoded query pa… | |
| 40 | Tracking | high | js/background.js (line 5354) | The extension establishes a command-and-control style communication channel with cursorstore.com/api/action/index.php. It sends base64-encoded user telemetry (extension ID, version, generated user ID, timestamp) and c… | |
| 41 | Tracking | high | js/background.js (line 13) | On uninstall, the extension fires a beacon to `https://cursorstore.com/uninstall/` carrying a base64-encoded payload with the extension's runtime ID, version, the persistent user UID, and a timestamp. While uninstall … | |
| 42 | Tracking | high | resources/js/main.js (line 1) | On install and update events, the extension immediately queues an action that triggers the remote server callback. Combined with the processQueue method, this means every install/update event phones home and the serve… | |
| 43 | Unauthorized Data Collection | high | js/background.js (line 13) | On first load, the extension silently generates a persistent unique user identifier via `generateID()` and stores it in extension storage. This UID is then included in every outbound telemetry call (install, update, u… | |
| 44 | Code Injection | medium | background.js (line 5389) | On install, the extension enumerates ALL open tabs and injects cursor-injector.js into every HTTP/HTTPS tab. While this is part of the cursor functionality, it's an aggressive use of chrome.scripting.executeScript acr… | |
| 45 | Code Injection | medium | cursor-injector.js (line 4902) | Cursor SVG data (potentially fetched from cursorstore.com) is injected into every page via style.innerHTML across all frames. The SVG content is encoded via encodeURIComponent but the data flows from an external serve… | |
| 46 | Code Injection | medium | background.js (line 5384) | On install, the extension enumerates ALL open tabs and injects scripts into every HTTP/HTTPS tab using chrome.scripting.executeScript. While this has a legitimate use (applying cursors immediately), the broad scope co… | |
| 47 | Code Injection | medium | content_site.js (line 4936) | The showAlert function in content_site.js concatenates parameters directly into innerHTML without sanitization. If the title or text parameters contain HTML from attacker-controlled data, this creates a DOM-based XSS … | |
| 48 | Code Injection | medium | background.js (line 5383) | On install, the extension immediately enumerates ALL open tabs and injects scripts into every one that matches (which is effectively all HTTP/HTTPS pages). This bulk injection into all existing tabs at install time is… | |
| 49 | Code Injection | medium | background.js (line 4970) | On first install, the extension enumerates ALL open tabs and programmatically injects cursor-injector.js into every HTTP/HTTPS tab. While this is nominally to apply the cursor immediately, it demonstrates aggressive u… | |
| 50 | Code Injection | medium | background.js (line 4969) | On install, the extension enumerates ALL open tabs and injects scripts into every qualifying tab using chrome.scripting.executeScript. It injects cursor-injector.js into all http/https pages and content_site.js into c… | |
| 51 | Code Injection | medium | background.js (line 4973) | On install, the extension enumerates ALL open tabs and programmatically injects content scripts into every one matching http/https URLs. This uses chrome.scripting.executeScript across all tabs, going beyond the decla… | |
| 52 | Code Injection | medium | cursor-injector.js (line 4464) | The cursor injector writes CSS rules directly into a <style> tag using innerHTML on every page the user visits. The cursor SVG data comes from chrome.storage (originally fetched from cursorstore.com API). If a malicio… | |
| 53 | Code Injection | medium | background.js (line 5096) | On install, enumerates ALL open tabs and programmatically injects scripts into every valid HTTP/HTTPS tab using chrome.scripting.executeScript. While this serves the cursor functionality, it demonstrates aggressive in… | |
| 54 | Code Injection | medium | resources/js/main.js (line 1) | On install, iterates over ALL open tabs and injects code via chrome.tabs.executeScript into every HTTP/HTTPS page. While the injected code itself just adds a CSS stylesheet, the pattern of programmatically injecting i… | |
| 55 | Code Injection | medium | resources/js/main.js (line 1) | On install, immediately iterates ALL open tabs and injects code via chrome.tabs.executeScript into every HTTP/HTTPS page. While the injected code itself adds a CSS stylesheet, the pattern of enumerating and scripting … | |
| 56 | Code Injection | medium | resources/js/main.js (line 1) | On install, iterates over ALL open tabs and injects code via chrome.tabs.executeScript using string-based code construction. While the injected code itself just adds a CSS class, the pattern of mass-injecting into all… | |
| 57 | Code Injection | medium | resources/js/main.js (line 1) | Uses chrome.tabs.executeScript with string concatenation to inject the cursor class name into page context. While the class values come from storage (not direct user input), the pattern of building executable code str… | |
| 58 | Phishing | medium | background.js (line 5401) | The 'open_link' message handler navigates the current active tab to any URL provided in the message payload without any validation or URL sanitization. Any content script or the popup can trigger arbitrary navigation … | |
| 59 | Phishing | medium | js/background.js (line 5427) | The 'open_link' message handler navigates the user's active tab to any arbitrary URL passed via runtime message. While used by the popup to open cursorstore.com links, this handler accepts any URL without validation, … | |
| 60 | Phishing | medium | js/background.js (line 5429) | The background script accepts an 'open_link' message from content scripts and navigates the active tab to any arbitrary URL. Since content scripts run on all pages, this creates a mechanism where any page (or the exte… | |
| 61 | Privilege Escalation | medium | background.js (line 5404) | The 'open_link' message handler navigates the active tab to any URL provided in t.link without validation. Any content script or the cursorstore.com site (via content_site.js) can send this message to redirect users t… | |
| 62 | Privilege Escalation | medium | background.js (line 5399) | The 'open_link' message handler navigates the active tab to any URL sent via chrome.runtime.sendMessage without any validation or origin check. Content scripts on cursorstore.com (content_site.js) can trigger this, bu… | |
| 63 | Privilege Escalation | medium | manifest.json (line 18) | The content script runs on ALL URLs, in ALL frames (including iframes), at document_start — the earliest possible execution point. Combined with <all_urls> host permissions, this gives the extension maximum reach into… | |
| 64 | Privilege Escalation | medium | manifest.json (line 18) | The cursor-injector.js content script is injected into ALL URLs on ALL frames at document_start. While needed for cursor customization, this gives the extension code execution on every page the user visits, including … | |
| 65 | Privilege Escalation | medium | background.js (line 4988) | The background script accepts an 'open_link' message and navigates the active tab to any arbitrary URL. While currently only triggered from internal extension pages, this message handler could be exploited if the curs… | |
| 66 | Privilege Escalation | medium | content_site.js (line 24) | A content script (content_site.js, ~71KB bundled) runs at document_start on cursorstore.com and staging.cursorstore.com. Running at document_start with a large bundled script on the extension's own website is suspicio… | |
| 67 | Privilege Escalation | medium | js/background.js (line 5399) | On install, the extension enumerates ALL open tabs and injects content.js into every HTTP/HTTPS page. This is overly aggressive — a cursor-changing extension should not need to programmatically inject scripts into eve… | |
| 68 | Privilege Escalation | medium | js/background.js (line 5195) | The URL matching function accepts virtually all HTTP and HTTPS URLs, only excluding chrome.google.com, chrome-error://, view-source:, and file:// pages. This extremely broad matching allows content script injection in… | |
| 69 | Privilege Escalation | medium | manifest.json (line 18) | The manifest requests broad host permissions (http://*/* and https://*/*) plus tabs and activeTab, combined with content scripts on <all_urls>. For a cursor customization extension, this is overly permissive. The tabs… | |
| 70 | Remote Code Loading | medium | background.js (line 5333) | The extension fetches cursor data from cursorstore.com via an axios HTTP call and processes the response without integrity checks. If cursorstore.com were compromised, it could serve arbitrary SVG content that gets in… | |
| 71 | Remote Code Loading | medium | content_site.js (line 4925) | The content script on cursorstore.com reads a URL from a DOM data attribute and sends it to the background script to fetch cursor data. The background script then fetches from cursorstore.com + the provided path witho… | |
| 72 | Remote Code Loading | medium | background.js (line 4912) | The addCollectionByUrl handler fetches cursor data from a URL path appended to cursorstore.com. The URL path comes from message passing (content_site.js sends it), meaning the cursorstore.com website can trigger the e… | |
| 73 | Remote Code Loading | medium | background.js (line 4915) | Fetches cursor collection data from cursorstore.com using a URL path received via chrome.runtime message (add_collection_by_url action). The URL path is not validated or sanitized before being appended to the base URL… | |
| 74 | Remote Code Loading | medium | cursor-injector.js (line 3943) | Fetches SVG cursor images from remote URLs (cursorstore.com or arbitrary URLs if cursor data starts with 'http'). The fetched SVG content is processed with minimal sanitization (only XML declarations and comments stri… | |
| 75 | Remote Code Loading | medium | background.js (line 4905) | The 'add_collection_by_url' handler takes a user-controlled URL path and fetches data from cursorstore.com + that path. The fetched cursor data is then processed and stored. While the base URL is hardcoded, the path i… | |
| 76 | Remote Code Loading | medium | js/background.js (line 13) | The `addCollectionByUrl` method constructs a URL by concatenating `https://cursorstore.com` with a caller-supplied path and fetches cursor data from it, then installs whatever the server returns as extension cursors. … | |
| 77 | Tracking | medium | background.js (line 5374) | The extension generates and persists a unique user identifier using a random string combined with a timestamp (Math.random().toString(36) + Date.now().toString(36)). This ID is stored in chrome.storage and used to tra… | |
| 78 | Tracking | medium | background.js (line 4926) | The extension generates a persistent pseudo-random user ID on first run and stores it in chrome.storage. This creates a tracking identifier that persists across sessions. While common in extensions, combined with the … | |
| 79 | Tracking | medium | background.js (line 5396) | On every install/update event, the extension phones home to cursorstore.com/wi/ with the install reason, then processes the JSON response through 'newFeatures'. This is a tracking beacon that reports install/update ev… | |
| 80 | Tracking | medium | background.js (line 4926) | Generates a pseudo-unique user identifier combining random characters and timestamp, stored persistently. This creates a trackable fingerprint for the user across sessions without explicit consent, used in the SET_USE… | |
| 81 | Tracking | medium | background.js (line 4982) | On every install or update event, the extension sends the install/update reason to cursorstore.com via the 'wi/' endpoint (likely 'web install' tracking). This silently reports extension lifecycle events to the remote… | |
| 82 | Tracking | medium | background.js (line 4956) | Generates and persists a unique user identifier using a random alphanumeric string combined with a timestamp (Math.random().toString(36) + Date.now().toString(36)). This fingerprint is stored in chrome.storage and per… | |
| 83 | Tracking | medium | background.js (line 4981) | On every install/update event, the extension sends the install reason to cursorstore.com/wi/ as a tracking beacon. The response is then passed to newFeatures() which can open arbitrary URLs. This is an install-trackin… | |
| 84 | Tracking | medium | background.js (line 4955) | The extension generates and persists a unique user tracking ID using a random+timestamp-based algorithm (Math.random + Date.now in base36). This persistent identifier is stored in chrome.storage and could be used to t… | |
| 85 | Tracking | medium | background.js (line 4965) | Every time the user installs a cursor, a fire-and-forget beacon is sent to `https://cursorstore.com/api/cursors/install/<cursor_id>` with no user consent or disclosure in the extension's permissions or privacy policy.… | |
| 86 | Tracking | medium | background.js (line 4935) | Sends an unacknowledged fire-and-forget fetch to cursorstore.com/api/cursors/install/{cursor_id} every time a cursor is added. This phones home to the extension developer's server without explicit user consent or disc… | |
| 87 | Tracking | medium | background.js (line 4959) | The extension generates a persistent pseudorandom user ID on first run and stores it in chrome.storage. This creates a tracking identifier that persists across browsing sessions without user consent or disclosure, ena… | |
| 88 | Tracking | medium | background.js (line 4935) | Every time a cursor is installed, a fire-and-forget fetch request is sent to cursorstore.com API (https://cursorstore.com/api/cursors/install/{id}). The response is completely ignored. This is a server-side tracking b… | |
| 89 | Tracking | medium | background.js (line 5057) | Sets an uninstall URL that sends the user's unique tracking ID, extension version, and timestamp to cursorstore.com/uninstall/index.php when the extension is removed. This tracks users even during uninstallation, tran… | |
| 90 | Tracking | medium | background.js (line 4958) | A persistent user tracking ID is generated and stored in chrome.storage. This ID is sent with every request to the remote server (action, config, and uninstall URLs) as base64-encoded JSON in the 'uid' field, enabling… | |
| 91 | Tracking | medium | background.js (line 5056) | Sets a custom uninstall URL that exfiltrates the persistent user ID, extension version, and timestamp to the remote server when the extension is uninstalled. This enables tracking of the extension uninstall event with… | |
| 92 | Tracking | medium | js/background.js (line 5384) | Sets a dynamic uninstall URL that transmits the persistent user tracking ID, extension ID, version, and timestamp to cursorstore.com when the user removes the extension. This enables cross-session user fingerprinting … | |
| 93 | Tracking | medium | js/background.js (line 5386) | Sets an uninstall URL that transmits base64-encoded user tracking data (persistent user ID, extension version, timestamp) to the cursorstore.com server when the extension is removed. This enables cross-session user tr… | |
| 94 | Tracking | medium | resources/js/main.js (line 1) | Sets an uninstall URL that transmits a base64-encoded payload containing the persistent unique user ID, extension ID, version, and timestamp to cutecursore.com. This enables cross-session user tracking even upon unins… | |
| 95 | Tracking | medium | resources/js/main.js (line 1) | Sets an uninstall URL that transmits the persistent UID, extension ID, version, and timestamp to https://cutecursore.com/uninstall/. This tracks individual users across install/uninstall lifecycle events, which is dis… | |
| 96 | Tracking | medium | resources/js/main.js (line 1) | Sets an uninstall URL that exfiltrates a persistent unique user identifier (UID), extension ID, version, and timestamp to cursorstore.com/uninstall/. This enables cross-session user tracking even after the extension i… | |
| 97 | Tracking | medium | resources/js/main.js (line 1) | Generates a persistent unique identifier stored in chrome.storage.local and sent with every telemetry beacon to cursorstore.com. This enables long-term individual user tracking across browsing sessions without user co… | |
| 98 | Unauthorized Data Collection | medium | background.js (line 4983) | On first launch the extension silently generates a persistent UUID (`Object(c.a)()`) and stores it as `storage.user.id`. This unique identifier is available to all API calls made to `cursorstore.com` and persists acro… | |
| 99 | Unauthorized Data Collection | medium | background.js (line 4513) | Generates a pseudo-unique user identifier from Math.random() and Date.now(), used for persistent tracking across all server communications. This weak-entropy ID is stored in chrome.storage and sent with every phone-ho… | |
| 100 | Unauthorized Data Collection | medium | background.js (line 4513) | Custom fingerprint-like ID generation function that combines random characters with a timestamp-derived component, then randomly capitalizes characters. This creates a persistent pseudo-unique identifier used to track… | |
| 101 | Unauthorized Data Collection | medium | background.js (line 4783) | The bundled axios library includes cookie read/write utilities that can access and manipulate document.cookie. While this is part of the axios XSRF protection mechanism (configured with 'XSRF-TOKEN' cookie name at lin… | |
| 102 | Unauthorized Data Collection | medium | js/background.js (line 5469) | On first load, generates a persistent unique user ID stored in chrome.storage.local and transmitted to the remote server with every action event. Combined with the tracking beacon in processQueue, this creates a persi… | |
| 103 | Unauthorized Data Collection | medium | js/background.js (line 5469) | A persistent unique user ID is generated on first run and stored in chrome.storage. This ID is sent with every action request and uninstall URL, enabling long-term user tracking across sessions. The generateID functio… | |
| 104 | Unauthorized Data Collection | medium | resources/js/main.js (line 1) | Generates a persistent UUID-like identifier stored in chrome.storage.local and sent with every network request to the remote server. This creates a durable fingerprint for tracking individual users across sessions wit… | |
| 105 | Unauthorized Data Collection | medium | resources/js/main.js (line 1) | Generates and persists a unique user identifier (UUID) in chrome.storage.local. This UID is transmitted with every phone-home request and the uninstall URL, enabling persistent cross-session tracking of individual use… | |
| 106 | Code Injection | low | content_site.js (line 4893) | The content_site.js script injects a broad click event listener on cursorstore.com pages that reads img.src values from the DOM and dispatches them to the extension's Vuex store. If cursorstore.com's DOM were manipula… | |
| 107 | Code Injection | low | content_site.js (line 4936) | Uses innerHTML with string concatenation to inject content into the page DOM on the cursorstore.com site. If the title or message parameters contain user-controlled or server-controlled data, this is a potential XSS v… | |
| 108 | Code Injection | low | content_site.js (line 1486) | The showAlert function uses innerHTML with string concatenation of the title and text parameters without any sanitization. If cursorstore.com passes unsanitized data, this could enable DOM-based XSS. While this only r… | |
| 109 | Code Injection | low | js/content_site.js (line 5167) | The showAlert function in content_site.js injects unsanitized parameters into innerHTML on cursorstore.com pages. If cursorstore.com provides malicious data-title or data-collection-title attributes, this could enable… | |
| 110 | Tracking | low | background.js (line 5353) | When a cursor is installed, a fire-and-forget fetch is made to cursorstore.com/api/cursors/install/{id}. Combined with the generated user ID stored in the extension, this tracks user behavior (which cursors they insta… | |
| 111 | Tracking | low | background.js (line 4931) | User fingerprinting function that generates a pseudo-unique identifier combining Math.random() with Date.now() timestamp. This identifier persists across sessions in chrome.storage and is associated with cursor instal… | |
| 112 | Tracking | low | background.js (line 5366) | Sets an uninstall URL that directs to cursorstore.com/contact-us. While this is a common practice, it enables the server to track uninstall events and potentially correlate them with the persistent user ID stored in t… | |
| 113 | Tracking | low | background.js (line 5348) | Every cursor installation fires a tracking beacon to cursorstore.com/api/cursors/install/{id}. The response is not used — this is purely server-side analytics. Combined with the persistent user ID, this enables detail… | |
| 114 | Tracking | low | background.js (line 5348) | Every time a cursor is installed, a tracking request is sent to the cursorstore.com API with the cursor ID. This tracks individual user cursor installation behavior server-side without explicit user consent or disclos… | |
| 115 | Tracking | low | background.js (line 4514) | The unique tracking ID generator creates a randomized, mixed-case alphanumeric identifier combining Math.random and Date.now. This persistent ID can be used to correlate user activity across sessions and potentially a… | |
| 116 | Tracking | low | background.js (line 4936) | Every cursor installation fires a tracking beacon to the remote API (cursorstore.com/api/cursors/install/{id}) without user awareness. This reports individual cursor selection events to the server, building a behavior… | |
| 117 | Tracking | low | background.js (line 4954) | Sets an uninstall URL that directs users to cursorstore.com/contact-us on extension removal. While not inherently malicious, this is a common pattern used to track uninstall events and can be combined with the persist… | |
| 118 | Tracking | low | background.js (line 4513) | User ID generation function creates a pseudo-random identifier by combining Math.random() with the current timestamp in base36, then randomly capitalizes characters to add entropy. This fingerprint-like ID is generate… | |
| 119 | Tracking | low | background.js (line 4935) | Every time a cursor is added/installed, the extension sends a tracking beacon to cursorstore.com/api/cursors/install/{id}. This silently reports user behavior (which cursors they install) to the remote server without … | |
| 120 | Tracking | low | background.js (line 4959) | Generates and persists a unique user identifier on first run using a random+timestamp ID generator. The ID is stored in chrome.storage.local and shared across all extension contexts. While used for cursor install trac… | |
| 121 | Tracking | low | background.js (line 4513) | Generates a pseudo-unique tracking identifier by combining Math.random() with Date.now() in base36. This ID is assigned to users and persisted, enabling cross-session user tracking via the cursorstore.com API calls. | |
| 122 | Tracking | low | manifest.json (line 38) | The manifest explicitly whitelists `https://ssl.google-analytics.com` as a permitted script source in the Content Security Policy. This intentional CSP relaxation allows Google Analytics tracking scripts to execute wi… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
19
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| www.w3.org | /1999/02/22-rdf-syntax-ns | http://www.w3.org/1999/02/22-rdf-syntax-ns# |
| ns.adobe.com | /xap/1.0/ | http://ns.adobe.com/xap/1.0/ |
| ns.adobe.com | /xap/1.0/mm/ | http://ns.adobe.com/xap/1.0/mm/ |
| ns.adobe.com | /xap/1.0/sType/ResourceRef | http://ns.adobe.com/xap/1.0/sType/ResourceRef# |
| www.w3.org | /2000/svg | http://www.w3.org/2000/svg |
| www.w3.org | /1999/xlink | http://www.w3.org/1999/xlink |
| ns.adobe.com | /xap/1.0/sType/ResourceEvent | http://ns.adobe.com/xap/1.0/sType/ResourceEvent# |
| ns.adobe.com | /photoshop/1.0/ | http://ns.adobe.com/photoshop/1.0/ |
| purl.org | /dc/elements/1.1/ | http://purl.org/dc/elements/1.1/ |
| www.w3.org | /1998/Math/MathML | http://www.w3.org/1998/Math/MathML |
Showing 1 to 10 of 20 rows
Rows per page:
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.