Top Risks

• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — scores max privacy risk.
• proxy + webRequest + <all_urls> allows full traffic interception and rerouting across all sites.
• No CSP declared (MV3 default applies, but external hosts include cdnjs.cloudflare.com — CDN dependency).
• No developer display name in listing; rating 3.8 may reflect user trust concerns.
• 12 external JS hosts referenced; cdnjs.cloudflare.com is a CDN that could serve third-party code.

Evidence

• proxy+webRequest+<all_urls> manifest Triple high-risk combination: proxy control, request observation, and broad host access on all URLs.
• privacy_policy_scope_extension=false + data_collection=true + third_party_sharing=true api Policy fetched but not scoped to extension; admits data collection and third-party sharing — v3.5-D applies (+10.0).
• no_csp manifest content_security_policy is null; MV3 provides default but no explicit hardening declared.
• cdnjs.cloudflare.com in js_external_hosts crx Extension references cdnjs.cloudflare.com; CDN script supply chain risk.
• no_developer_name store developer_name is empty string; no verified publisher badge.
• rating=3.8 store Below-average rating; rating_count unknown so +1.0 penalty not triggered (no confirmed >=50 ratings).
• no_bad_hosts_no_affiliates_no_monetization api threat_intel shows no bad hosts, affiliate hits, or monetization hits — positive signal.
• months_since_update=0 store Updated June 2026; actively maintained, no staleness penalty.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxies — core VPN/proxy risk surface.
• webRequest high Can observe all network requests across all URLs via host_permissions <all_urls>.
• webRequestAuthProvider high Can intercept and supply proxy authentication credentials.
• <all_urls> high Broad host access; pairs with proxy/webRequest for full traffic visibility.
• tabs medium Access to tab URLs and metadata across all open tabs.
• downloads medium Can manage download activity.
• notifications low Can display notifications; limited direct risk.
• contextMenus low UI affordance only; low risk.
• storage low Local storage for proxy config; expected for this category.

Pillar Scores

Bookkeeping