Top Risks

• proxy permission allows complete traffic interception with no verifiable infrastructure disclosed
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no business website — identity unverifiable
• No installs or rating data; new obscure extension with powerful network capability
• No CSP on MV3 and no auditable code surface for a proxy tool handling all user traffic

Evidence

• proxy_permission manifest proxy declared — can redirect all Chrome traffic through arbitrary servers with no host restriction disclosed.
• free_webmail_developer store Developer email asdro1905@gmail.com; no developer name; no business website. Identity unverifiable.
• generic_privacy_policy store Privacy policy URL is Google's own account policy (not scoped to extension); scope_extension=false, data_collection=true, third_party_sharing=true.
• no_installs_no_rating store Install count empty, rating 0 — no community signal to assess trustworthiness.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 VPN extension.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• no_code_findings crx code_findings_raw empty; obfuscation_score 0.0; 2 JS files scanned.
• no_bad_hosts api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; no external JS hosts.

Permissions Breakdown

• proxy high Proxy permission allows full routing of browser traffic through attacker-controlled servers; critical capability.

Pillar Scores

Bookkeeping