Top Risks

• Brand impersonation of TunnelBear VPN — free-webmail dev with 145 installs, no verified publisher status.
• Install URL hijack opens skorostvpn.space on install — classic drop-traffic monetization shell.
• proxy permission routes ALL browser traffic through developer-controlled infrastructure.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• No developer name and free-webmail (gmail) developer with no business domain adds accountability risk.

Evidence

• install_url_hijack crx onInstalled opens https://skorostvpn.space/ — monetization/tracking redirect on install.
• brand_impersonation_name store Extension named 'Tunnel-Bear VPN' mimicking TunnelBear brand; developer is free-webmail gmail account, not McAfee/TunnelBear.
• free_webmail_no_dev_name store Developer email namikkm13@gmail.com, developer_name empty — no accountable identity.
• generic_privacy_policy api Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to extension.
• proxy_permission manifest proxy declared — allows full rerouting of browser network traffic, highest-impact VPN capability.
• external_host_skorostvpn crx js_external_hosts includes skorostvpn.space — unknown third-party domain, also install hijack target.
• small_install_high_perm store 145 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span CA, RU, US — includes Russian-geolocated host (skorostvpn.space), 3 countries.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through an arbitrary proxy — maximum network interception capability.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS host access; necessary for a VPN/proxy tool but still a sensitive network endpoint.
• https://dns.google/* medium DNS-over-HTTPS host access; same rationale as cloudflare-dns.

Pillar Scores

Bookkeeping