Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing==true: admits data sharing without scoping to this extension.
• Proxy + webRequest + broad host access (*://*/*) gives full traffic interception capability on all browsing.
• Developer email is free webmail (gmail) with no verified business name; verified_publisher partially mitigates.
• management permission allows enumerating and disabling other installed extensions.

Evidence

• privacy_policy_scope_mismatch api Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true: triggers +10.0 privacy (v3.5 rule D).
• uninstall_url_hijack crx uninstall_url_hijack=true; target not extractable. +3.0 Webstore per rubric.
• free_webmail_developer store developer_email=brocodeltd@gmail.com, developer_name empty. +1.5 Reputation (free webmail, no business website).
• verified_publisher_featured store verified_publisher=true, is_featured_by_google=true. Applies discount but capped by monetization/staleness checks.
• high_capability_permissions manifest proxy+webRequest+webRequestAuthProvider+management+*://*/* — capability gate (0b) limits recognized-org discount.
• code_findings_function_constructor crx new Function() constructor in 3 files (options.js, serviceWorker.js, popup.js). +2.5 Code Quality.
• js_external_hosts crx 6 external hosts: analytics.uvpn.me, api.uvpn.me, geo.uvpn.me, manage.uvpn.me, uvpn.me, www.google.com — all uvpn.me dev-controlled.
• installs_1m_rating_4.5 store 1,000,000 installs, rating 4.5. +1.0+1.0+0.5 Webstore install scale; -0.5 popularity-as-trust.

Permissions Breakdown

• webRequest high Intercepts all network requests; core to VPN function but high abuse potential.
• webRequestAuthProvider high Can supply credentials to auth challenges, proxy auth for VPN use.
• proxy high Full control over browser proxy settings; expected for VPN but critical capability.
• storage low Local config/settings storage.
• alarms low Periodic background tasks, low risk.
• tabs medium Access to tab URLs and metadata across all tabs.
• offscreen medium Creates offscreen documents; can execute JS outside visible context.
• management high Can list/disable/enable other extensions; significant privilege.
• *://*/* high Broad host access to all URLs; combined with proxy/webRequest amplifies risk.

Pillar Scores

Scoring History

Bookkeeping