Is Roblox Characters Custom Cursor safe?

Medium risk

Roblox Characters Custom Cursor loads selected cursor images from allcursor.com on pages you visit.

When you choose a custom cursor, the extension stores cursor image URLs and injects them into visited pages. The browser then requests those images from allcursor.com in the page context, which can send the page referrer and your IP address to that domain.

cursorrobloxv1.3Chrome Web Store
48Risk
Who publishes it

cursorroblox - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cursorroblox
Website
allcursor.com/contact-us

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Custom cursors send browsing referrers to allcursor.com

When you select a custom cursor, the extension applies cursor image URLs from allcursor.com across pages you browse.

Those browser requests can include the current page as the referrer and also expose your IP address to allcursor.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user selects a custom cursor.

The extension did this

The extension applies cursor CSS that loads images from allcursor.com on visited pages.

Captured request
GEThttps://allcursor.com/imagesize/{width}/{height}/{imageName}
Fields in the request
  • Visited page URL
    https://www.example.com/page (illustrative)

    The page address can be included as the HTTP referrer when the cursor image is fetched.

  • Page referrer
    https://www.example.com/account (illustrative)

    The referrer can show which site or page caused the remote cursor image request.

  • IP address
    203.0.113.42 (illustrative)

    The remote service receives the network address used to fetch the cursor image.

What it can do

Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Roblox Characters Custom Cursor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • allcursor.com

    Roblox Characters Custom Cursor sends data to allcursor.com. No other extension we have analysed sends data here.

Updated 30 September 2026onlebljiolgmajcgmhnlpddfedichgcf