Top Risks

• proxy + broad host access lets extension redirect all browser traffic; eval() of server-received data amplifies RCE-like risk if server is compromised.
• Privacy policy fetched but scope_extension==false and data_collection==true — policy admits data collection without scoping to this extension.
• eval_user_input in thrift.js evaluates raw server response; combined with proxy capability this is a critical code-execution path.
• Two innerHTML DOM-XSS sinks with no CSP present — no mitigations against content injection in popup/options UI.
• No developer name listed in store; install_url_hijack==true opens unverified URL on install.

Evidence

• proxy+broad_host_access manifest proxy permission + http://*/* + https://*/* gives full traffic interception/redirection capability across all sites.
• eval_user_input crx js/network/thrift.js calls eval(received) on server-returned data — arbitrary code execution if server/MITM is hostile.
• dom_sink_innerhtml_userctrl crx options.js and popup.js both assign variable content to innerHTML with no CSP guard.
• privacy_policy_scope_mismatch store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=false — generic policy admitting collection.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening for extension pages.
• install_url_hijack crx install_url_hijack==true; target URL null — onInstalled opens third-party URL.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped due to active maintenance.
• no_developer_name store developer_name is empty string in listing metadata; only email support@anonymox.net provided.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxies — core to VPN function but critical capability.
• webRequest high Can intercept and observe all HTTP/S requests across all URLs.
• webRequestAuthProvider high Can supply authentication credentials for network requests — sensitive capability.
• declarativeNetRequest medium Can modify/block network requests; medium risk given VPN category alignment.
• http://*/* high Broad host access over all HTTP origins — paired with proxy creates high-impact surface.
• https://*/* high Broad host access over all HTTPS origins — paired with proxy creates high-impact surface.
• storage low Local preference storage; standard low-risk use.
• offscreen low Background DOM rendering; low risk in isolation.
• alarms low Scheduling/timer capability; low risk.

Pillar Scores

Bookkeeping