Top Risks

• proxy + webRequest + broad host access enables full traffic interception and rerouting by an unofficial developer on a free subdomain.
• Uninstall URL hijack to goodextensions.mooo.com and install URL hijack signal monetization/tracking on install/uninstall lifecycle.
• JS external hosts include ad-ninja.net and skipply.net — ad/redirect networks inconsistent with a privacy-focused tool.
• Title impersonates Tor Browser brand without affiliation, misleading users about anonymity guarantees.
• No CSP and two innerHTML DOM-XSS sinks increase XSS exploitability if proxy-fed content is attacker-controlled.

Evidence

• proxy+webRequest+all_urls manifest proxy, webRequest, webRequestAuthProvider with http://*/* and https://*/* — full traffic control by unverified dev.
• uninstall_url_hijack crx Uninstall redirects to https://goodextensions.mooo.com/ext/tor-browser/bay-bay.html (3rd-party lifecycle tracking).
• ad_network_js_hosts crx js_external_hosts includes ad-ninja.net and skipply.net — ad/redirect networks in a privacy tool.
• brand_impersonation_title store Title 'Tor Browser (Unofficial port)' leverages Tor brand; confirmed_owner==false.
• no_csp_with_dom_xss_sinks crx csp_present=false; two innerHTML sinks found — XSS risk amplified with proxy capability.
• developer_domain_free_subdomain store Dev domain goodextensions.mooo.com is a free dynamic-DNS subdomain (mooo.com), low accountability.
• install_url_hijack crx install_url_hijack=true — onInstalled likely opens 3rd-party URL.
• privacy_policy_third_party_sharing api Policy fetched, scoped, admits data collection and third-party sharing; retention disclosed.

Permissions Breakdown

• webRequestAuthProvider high Can supply credentials for any auth challenge — credential interception risk.
• http://*/* high Broad host access to all HTTP sites; paired with proxy/webRequest is critical.
• https://*/* high Broad host access to all HTTPS sites; paired with proxy/webRequest is critical.
• storage low Local data persistence; low standalone risk.
• proxy high Can reroute all browser traffic through attacker-controlled endpoints.
• webRequest high Intercept and inspect all network requests across all URLs.

Pillar Scores

Bookkeeping