Is Best Cursors - Bloom of Custom Cursors safe?

Best Cursors exposes a stored user identifier and cursor collection to any website via unguarded message handlers.

The extension's content script responds to postMessage requests from any web page—without checking the caller's origin—by returning a persistent user ID stored in local storage. Its background script additionally accepts external messages from any website, allowing any page to read the full list of downloaded cursors or write arbitrary cursor data into extension storage. No domain restrictions or authentication checks are applied to these interfaces.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.