South Park Cursor - Custom Cartoon Cursor for Chrome

On every install or update, the extension programmatically injects content.js into ALL currently open browser tabs across every domain. While applying cursor styling to already-open tabs is plausible, retroactively injecting a script into every open tab (banking, email, internal tools, etc.) via the scripting API is far more aggressive than the passive content_scripts declaration already present in the manifest, and creates a broad runtime code-injection surface on all user pages simultaneously.

chrome.runtime.onInstalled.addListener(function(c) {  chrome.tabs.query({    url: ["https://*/*", "http://*/*"]  }, (tabs) => {    Array.from(tabs)      .forEach((tab) => {        if (          tab.url &&          tab.url.indexOf("https://chrome.google.com/webstore/") === -1        ) {          chrome.scripting.executeScript({              target: {                tabId: tab.id              },              files: ["content.js"],            },            () => {              if (chrome.runtime.lastError)                console.log(chrome.runtime.lastError.message);            },          );        }      });  });});

The service worker unconditionally queries for all open tabs on the publisher's own domain (tabplugins.com) and force-reloads them every time the extension's service worker starts. A cursor extension has no legitimate reason to reload tabs on its developer's website; this pattern is consistent with forcing fresh ad impressions, resetting affiliate tracking cookies, or triggering analytics beacons on publisher-controlled pages.

chrome.tabs.query({  url: ["https://tabplugins.com/*"]}, (tabs) => {  // reload tabs to make all buttons work after extension is enabled  Array.from(tabs)    .forEach((tab) => {      chrome.tabs.reload(tab.id);    });});

The content script writes storage-sourced values directly into a style element's innerHTML on every page the user visits, with no sanitization or escaping. Although the values currently originate from the extension's own storage, a malicious update that writes crafted values (e.g., containing </style><script>) to storage could turn this into a persistent cross-site scripting vector affecting every page the user browses, given the extension's *://*/* content script scope.

sheetItem.innerHTML = css  .replace(/#cursor#/g, cursor_image1)  .replace(/#pointer#/g, cursor_image2)  .replace(/#pointerOffsetX#/g, cursor_image2_offs_x)  .replace(/#pointerOffsetY#/g, cursor_image2_offs_y)  .replace(/#cursorOffsetX#/g, cursor_image1_offs_x)  .replace(/#cursorOffsetY#/g, cursor_image1_offs_y);

The extension registers an uninstall tracking URL and opens a publisher-controlled webpage as a new tab on every fresh install. While individually not uncommon, combined with the tab-reload behavior in this extension these patterns indicate the publisher is aggressively instrumenting the install/uninstall lifecycle for analytics or affiliate revenue, using the browser as a traffic source without clear user consent.

chrome.runtime.setUninstallURL("https://tabplugins.com/cursors/");// ...if ("install" === c.reason) {  chrome.tabs.create({    url: "https://tabplugins.com/south-park-cursor/",  });

The popup calls storage.local.get(null, ...) which retrieves every key stored by the extension at once, rather than requesting only the specific cursor configuration keys it needs. Passing null as the key argument is an over-broad data read; if any sensitive values were ever written to storage (e.g., by a supply-chain update), this call would collect all of them in a single operation.

window.chrome.storage.local.get(null, e)