Top Risks

• proxy+webRequest+<all_urls> combo enables full traffic interception and rerouting on every site
• browsingData permission allows wholesale deletion of cookies and history
• privacy permission can disable WebRTC/DNS leak protections silently
• Only 73 installs with high-tier permissions: high tail-attack-surface acquisition risk
• Privacy policy admits third-party sharing; no scoping concern but data flows to third parties

Evidence

• high_capability_combo manifest proxy+webRequest+browsingData+privacy+<all_urls>: worst-case traffic hijack surface for a 73-install extension.
• install_perm_anomaly api small_install_high_perm=true; 73 installs with proxy+webRequest+browsingData+privacy.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; 9 JS files scanned cleanly.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• clean_threat_intel api No bad_host_hits, affiliate_hits, or monetization_hits. js_external_hosts: ip-api.com, proxysetup.com.
• privacy_policy_third_party store Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• developer_domain_resolves api proxysetup.com resolves; looks_throwaway=false; no operator siblings.
• justified_broad_discount_partial manifest PrivacyTool/VPN category warrants proxy+host access; -1.5 discount applied to permissions.

Permissions Breakdown

• proxy high Full proxy control; can reroute all browser traffic through attacker infrastructure.
• storage low Stores proxy profiles locally; expected for this category.
• privacy high Can modify WebRTC, DNS, and browser privacy settings globally.
• webRequest high Intercepts all network requests across all URLs.
• webRequestAuthProvider high Can supply proxy authentication credentials, enabling credential injection.
• declarativeNetRequest medium Declarative request blocking/modification; lower risk than webRequest but still broad.
• alarms low Scheduled tasks; minimal risk in isolation.
• tabs medium Can read tab URLs and navigate tabs.
• browsingData high Can delete browsing history, cookies, cache across all time ranges.
• <all_urls> (host) high Combined with proxy+webRequest grants full traffic interception on every site.

Pillar Scores

Bookkeeping