Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• proxy + webRequest + <all_urls>: full visibility and routing control over all browser traffic.
• management permission allows disabling/uninstalling other extensions — unusual for a VPN.
• 9 external JS hosts including Facebook, TikTok, Shopify, TinyURL — broad third-party telemetry surface.
• No CSP on MV3 extension with outbound requests to analytics and social platforms.

Evidence

• proxy+webRequest+<all_urls> combo manifest Core VPN permissions but grants full traffic interception across all URLs.
• management permission manifest Can enumerate and disable other installed extensions; not typical for a VPN product.
• 9 distinct external JS hosts crx Hosts: facebook.com, tiktok.com, shopify.com, tinyurl.com, bugsnag(x2), analytics-toolbar, auth, ai-protection subdomains.
• No CSP declared (MV3) manifest csp_present=false on MV3; no script-src restriction constraining external host contacts.
• function_constructor in content.js and service-worker crx new Function('return this') pattern present in two files; low-severity but noteworthy with broad host access.
• Privacy policy: third_party_sharing=true, retention=true, scoped api Policy fetched, scoped to extension, discloses collection/retention/3rd-party sharing. Adequate but sharing confirmed.
• developer domain resolves, not throwaway api urban-vpn.com resolves; no bad_host_hits or affiliate_hits; no operator siblings.
• Not verified publisher, not featured store verified_publisher=false, is_featured_by_google=false; reputation starts at baseline 5.0.

Permissions Breakdown

• proxy high Full proxy control over all browser network traffic — core VPN function but extreme capability.
• webRequest high Can observe and intercept all network requests across all URLs.
• webRequestAuthProvider high Can provide auth credentials to any network request — high abuse potential.
• management high Can enumerate, enable, disable, or uninstall other extensions.
• scripting medium Can inject scripts into pages; paired with <all_urls> host permission.
• tabs medium Access to tab URLs, titles, and navigation state.
• webNavigation medium Can observe all navigation events across all sites.
• <all_urls> high Broad host access covering all HTTP/HTTPS sites — required for VPN proxy but very broad.
• https://*.bugsnag.com/* low Scoped to crash-reporting service; known telemetry provider.
• storage low Local extension data storage only.
• alarms low Periodic background scheduling; low risk standalone.
• offscreen low Off-screen document for background processing; low standalone risk.

Pillar Scores

Bookkeeping