Top Risks

• proxy + webRequest + *://*/* enables full interception and rerouting of all browser traffic through developer-controlled servers
• Privacy policy is unscoped (scope_extension=false), collects data, shares with third parties — triggers +10.0 privacy score
• jquery@1.9.1 bundled with 3 medium CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11023); no CSP to mitigate DOM-XSS sinks
• Install and uninstall URL hijacks present; rating 2.4 indicates poor user experience or suspected abuse
• 12 external JS hosts including suspicious domains (91.notredamme.com, flag-gimn.ru, staging-server.worksqr.com) with no CSP

Evidence

• proxy+webRequest+all_urls manifest proxy, webRequest, webRequestAuthProvider paired with *://*/* — complete traffic interception capability for a VPN.
• privacy_policy_unscoped_with_data_sharing crx Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers D clause +10.0.
• jquery_1.9.1_three_medium_cves crx jquery@1.9.1 carries CVE-2015-9251, CVE-2019-11358, CVE-2020-11023 (all moderate); no CSP present.
• install_uninstall_url_hijack crx Both install_url_hijack and uninstall_url_hijack are true; targets not captured but pattern is monetization indicator.
• suspicious_external_hosts crx 12 external JS hosts including 91.notredamme.com, flag-gimn.ru, staging-server.worksqr.com — non-canonical for a VPN.
• no_csp_mv3 manifest content_security_policy is null; MV3 but no explicit CSP — amplifies CVE XSS risk from bundled jQuery.
• no_developer_name store developer_name is empty string; reduces accountability, +1.0 reputation.
• low_rating store Rating 2.4 with 60,000 installs; poor user trust signal.

CVE Exposures (3)

Permissions Breakdown

• proxy high Full control over all browser network traffic; can route traffic through arbitrary servers.
• webRequest high Can observe and intercept all HTTP/S requests; broad surveillance capability.
• webRequestAuthProvider high Can supply authentication credentials for network requests; credential-injection risk.
• *://*/* high Broad host access across all URLs; pairs with proxy/webRequest for full traffic interception.
• storage low Local extension data storage; standard, low direct risk.
• alarms low Scheduled callbacks; low risk in isolation.

Pillar Scores

Bookkeeping