Top Risks

• proxy permission lets developer route ALL browser traffic through any server they control — full MITM capability.
• Privacy policy is Google's generic account policy, not scoped to this extension; data practices undisclosed.
• Developer is anonymous (no name, free-webmail only) with 109 installs — impossible to verify identity.
• install_url_hijack detected: extension opens a third-party URL on install.
• VPN category warrants justified-broad discount on permissions, but anonymous dev and generic policy negate trust.

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser network traffic to attacker-controlled infrastructure.
• install_url_hijack store install_url_hijack == true; extension opens a URL on install, classic monetization/tracking shell signal.
• generic_privacy_policy store Privacy policy points to myaccount.google.com/privacypolicy — Google's own policy, not scoped to this VPN extension.
• anonymous_developer store developer_name empty; email reshilipogolove@gmail.com (free webmail). No verified publisher, not featured.
• small_install_high_perm api 109 installs with HIGH-tier proxy permission — tail attack surface flag raised.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit CSP declared.
• privacy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• no_code_findings crx 2 JS files scanned, obfuscation_score=0.0, code_findings_raw empty — no active malicious code detected.

Permissions Breakdown

• proxy high Can redirect all browser traffic through an arbitrary server — maximum MITM capability.
• storage low Local key-value store; low standalone risk.

Pillar Scores

Bookkeeping