Top Risks

• proxy permission routes all browser traffic through tarakanvpn.online — an unverified RU-hosted domain controlled by an anonymous developer.
• Privacy policy is Google's generic account policy — does not scope data collection to this extension at all; classified as third-party sharing admitted.
• Developer uses free Gmail, no name, no verified publisher — zero accountability signal for a network-routing tool.
• Only 46 installs with a HIGH-tier permission (proxy): classic tail-attack-surface pattern.
• Extension contacts external host tarakanvpn.online (RU geolocation) with no CSP — traffic destination unverifiable.

Evidence

• proxy_permission manifest proxy declared — full browser traffic redirection capability to tarakanvpn.online.
• external_js_host crx js_external_hosts: ['tarakanvpn.online'] — RU-geolocated, unknown operator, no bad-host hit but unverifiable.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 — no script restriction declared.
• generic_privacy_policy store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free Gmail, no verified publisher, no business domain.
• small_install_high_perm api install_perm_anomaly: 46 installs + proxy permission = tail-attack-surface flag.
• host_geo_russia api host_geo_diversity: country=[RU], single country — traffic exits through Russia-hosted infra.
• free_webmail_dev store Developer email egositburak@gmail.com — free webmail, no business presence verifiable.

Permissions Breakdown

• proxy high Allows full network proxy control — can redirect all browser traffic through attacker-controlled infrastructure.

Pillar Scores

Bookkeeping