Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy is generic (AdGuard-wide), not scoped to this Chrome extension's data practices
• chrome.runtime.setUninstallURL() redirects users on uninstall to an untracked destination
• Proxy and webRequest permissions grant full traffic interception across all URLs
• Not Web Store verified publisher despite claiming to be well-known AdGuard brand

Evidence

• permissions crx HIGH: proxy, webRequest, browsingData, management, privacy + <all_urls> host access
• permissions_discount crx -1.5 justified-broad discount: VPN category matches proxy/webRequest/<all_urls> surface
• featured_badge store is_featured_by_google=true (-2.0); verified_publisher=false; reputation floored at 2.0
• uninstall_hijack crx chrome.runtime.setUninstallURL() to 3rd-party destination (+3.0 webstore)
• privacy_policy_generic api Fetched OK but scope_extension=false, data_collection=true → +9.0 (generic AdGuard-wide policy)
• network_behavior crx <all_urls> + outbound requests (+2.0); CSP restricts to self; justified-network discount applied (-2.5)
• code_findings crx 3× new Function() + 3× innerHTML sinks; CSP present mitigates; obfuscation_score=0.0
• maintenance store Last updated Aug 2026, ~1 month ago; actively maintained (+0.0)

Permissions Breakdown

• browsingData high HIGH: Clears cookies, cache, history, site data across all browsing sessions
• contextMenus low LOW: Adds right-click menu items only
• management high HIGH: Can enumerate, enable, disable, or uninstall other extensions
• notifications low LOW: Displays system notifications
• offscreen low LOW: Creates offscreen documents for background processing
• privacy high HIGH: Modifies privacy settings (WebRTC, referrer policy, etc.)
• proxy high HIGH: Controls browser proxy configuration — core VPN functionality
• storage low LOW: Local extension storage
• unlimitedStorage low LOW: Unlimited local storage quota
• webRequest high HIGH: Intercepts and observes all network traffic
• webRequestAuthProvider high HIGH: Provides proxy authentication credentials
• <all_urls> (host_permissions + content_scripts) high HIGH: Broad host access; justified as VPN requires all-sites traffic routing

Pillar Scores

Bookkeeping