Top Risks

• Full traffic-control surface: proxy + webRequest + <all_urls> on all sites
• MV3 extension with NO content_security_policy declared
• Russian (.ru) developer domain — elevated geopolitical/jurisdiction risk for a VPN
• Tiny install base (500) with high-tier permissions (install_perm_anomaly)
• Free VPN with opaque business model; unverifiable developer identity

Evidence

• permissions crx proxy+privacy+webRequest+<all_urls> host and content_scripts — max capability for traffic interception
• category_justification crx VPN category: broad proxy/host access is functionally required; discount applied (-1.5)
• csp_missing crx content_security_policy null, csp_present=false on MV3 — no penalty per v2 (b)
• network_hosts crx External hosts: t.me, unlistvpn.com, unlistvpn.ru; <all_urls> + outbound requests
• verified_publisher store Web Store verified publisher badge; reputation floor 2.0 applied
• install_perm_anomaly api 500 installs with high-tier permission set (small_install_high_perm=true)
• privacy_policy store Scoped policy fetched; retention not disclosed; 3rd-party sharing admitted (+1)
• dev_domain api unlistvpn.ru resolves; first cert 2026-03-26; geo NL; no bad-host/monetization hits

Permissions Breakdown

• webRequest high Can observe all network traffic across sites.
• proxy high Can intercept and redirect all browser network traffic.
• privacy high Can modify browser privacy settings.
• webRequestAuthProvider medium Supplies auth credentials to network requests.
• declarativeNetRequest medium Can block/modify network requests declaratively.
• storage low Local extension storage only.
• <all_urls> (host) high Broad host access to every site; justified for VPN category.
• <all_urls> (content_scripts) high Script injection surface on all sites; combined with proxy is elevated.

Pillar Scores

Bookkeeping