Top Risks

• proxy + webRequest + *://*/* is maximum traffic interception capability for a VPN; all user traffic routable through extension.
• install_url_hijack and uninstall_url_hijack both flagged — onInstalled/onUninstalled open 3rd-party URLs.
• No dev display name in listing; developer identity relies solely on email domain.
• js_external_hosts includes sweb.ru (Russian hosting), www.example.com (placeholder), and marcusgroupco.com — unusual for a VPN.
• Privacy policy discloses third-party sharing with data collection; retention disclosed but sharing scope warrants scrutiny given 9M installs.

Evidence

• install_url_hijack crx install_url_hijack=true; target null — onInstalled fires to 3rd-party URL on install.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null — setUninstallURL to 3rd-party on removal.
• js_external_hosts_anomaly crx Hosts include sweb.ru, marcusgroupco.com, www.example.com alongside 1clickvpn.net domains.
• high_permissions_combo manifest proxy + webRequest + webRequestAuthProvider + *://*/* — full traffic interception stack.
• verified_publisher_featured store Verified publisher badge + is_featured_by_google=true; discount applied to reputation.
• monetization_hit api www.google-analytics.com in monetization_hits; only telemetry-tier, category=VPN.
• no_csp manifest content_security_policy is null; MV3 strict default applies so no v2 penalty added.
• privacy_policy_third_party_sharing api Policy fetched, scoped, data_collection+third_party_sharing=true, retention=true; +1.0 for sharing.

Permissions Breakdown

• proxy high Full proxy control; can intercept/redirect all browser traffic.
• webRequest high Observe and block network requests across all URLs.
• webRequestAuthProvider high Can supply credentials for HTTP auth challenges — credential interception risk.
• *://*/* high Broad host access; VPN category partially justifies but amplifies proxy risk.
• https://1clickvpn.net/api/ low Scoped to own API domain; expected for VPN tunnel management.
• storage low Local preference/state storage.
• unlimitedStorage low Removes storage quota; low standalone risk.
• alarms low Scheduled background tasks; low risk.

Pillar Scores

Bookkeeping