Top Risks

• proxy + broad host access (<all_urls>) enables complete browser traffic interception/rerouting by unverified dev
• Privacy policy URL returns SSL error (fetch_error:SSLError) — effectively no accessible policy; rated 10.0
• Last updated 33 months ago with 4 medium CVEs in bundled jquery@2.1.1 — zombie with known XSS libs
• Uninstall URL hijack flag set (uninstall_url_hijack=true) — post-removal tracking
• Rating 1.4 from an extension claiming to be TOR proxy; no Google verification; high impersonation risk

Evidence

• proxy + broad host permissions manifest proxy permission + http://*/ + https://*/ gives full traffic rerouting capability to unverified developer.
• privacy policy inaccessible crx fetch_error:SSLError on policy URL; classification shows fetched=false → Privacy pillar = 10.0.
• uninstall URL hijack crx uninstall_url_hijack=true; target null but flag raised — post-uninstall redirect configured.
• jquery@2.1.1 with 4 medium CVEs crx CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; all fixed in >=3.4.0; current=2.1.1.
• 33 months stale store Last updated Sep 2023; 33mo since update → Maintenance = 8.5 (24-36mo band).
• low rating 1.4 store Rating 1.4 — very low user satisfaction for a security-critical proxy extension.
• tail_attack_surface anomaly api install_perm_anomaly.tail_attack_surface=true; 4000 installs with HIGH-tier proxy permission.
• no CSP + DOM-manipulation lib with CVEs crx csp_present=false AND jquery@2.1.1 CVEs present; v2 jquery<3.5+no-CSP combo → code quality +2.0.

CVE Exposures (4)

Permissions Breakdown

• storage low Local key-value storage only; minimal risk.
• proxy high Can reroute all browser traffic; core TOR claim but powerful exfil/interception vector.
• http://*/ high Broad host access across all HTTP sites; pairs with proxy for full traffic interception.
• https://*/ high Broad host access across all HTTPS sites; same concern as HTTP host permission.

Pillar Scores

Bookkeeping