Top Risks

• proxy permission routes ALL browser traffic through tarakanvpn.online — unverified Russian server with no accountability.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection+third_party_sharing=true) — worst-case generic policy per v3.5 rule D: +10.0.
• Free-webmail dev (gmail) with no developer name and no business website — reputation floor triggered.
• JS external host tarakanvpn.online is an unknown foreign domain; extension loads or contacts it directly.
• Small install count (6) + HIGH-tier permission (proxy) — tail-attack-surface anomaly flagged.

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser network traffic to tarakanvpn.online.
• js_external_host crx tarakanvpn.online listed as external JS host; single-country geo (RU).
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• developer_identity store Free Gmail dev email norkienej@gmail.com, no developer name, no business website.
• install_perm_anomaly api Only 6 installs with HIGH-tier proxy permission — small_install_high_perm=true.
• dom_sink_innerhtml crx src/servers.js: innerHTML set from variable — DOM-XSS risk without CSP.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardens the extension pages.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no accountability signals.

Permissions Breakdown

• proxy high Reroutes all browser traffic through attacker-controlled SOCKS5 server at tarakanvpn.online.

Pillar Scores

Bookkeeping