Top Risks

• proxy permission allows complete traffic interception/redirection; install_url_hijack points to echosecure.space (RU-hosted unknown domain).
• Privacy policy is Google's generic account policy — no scope, no disclosure about what this VPN extension collects or shares.
• No developer identity: no name, no email, no verified publisher, no business website — zero accountability.
• Manifest name impersonates 'Hola VPN', a known brand, while actual infrastructure routes through echosecure.space.
• Extension opens echosecure.space on install; JS external host is the same RU-hosted domain with no transparency.

Evidence

• proxy_permission manifest proxy declared — can silently reroute all browser traffic to attacker-controlled server at echosecure.space.
• install_url_hijack crx install_url_target=https://echosecure.space/ — third-party domain opened on install, RU-hosted.
• js_external_host crx echosecure.space is the only external JS host; same as install hijack target — single opaque operator.
• no_developer_identity store developer_name, developer_email, and verified_publisher all missing/false — zero accountability surface.
• brand_impersonation_name manifest manifest_name='Hola VPN fre' mimics the well-known Hola VPN brand without verified ownership.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's policy, not extension-scoped; scope_extension=false.
• privacy_policy_generic_high_risk api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → D-clause +10.0.
• host_geo_single_ru crx All JS hosted in Russia (RU); no geo diversity but single-country low-diversity VPN shell pattern.

Permissions Breakdown

• proxy high Can redirect all browser traffic through an arbitrary proxy server — full network interception capability.

Pillar Scores

Bookkeeping