Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy is Google's generic policy (scope_extension=false, admits data_collection+third_party_sharing) — scores +10.0 per v3.5 rule D.
• proxy + webRequest + <all_urls> means all browser traffic can be intercepted and rerouted; management permission adds lateral extension control.
• Uninstall URL hijack detected — extension registers a 3rd-party uninstall redirect (+3.0 Webstore).
• External host api.kurva.cc is an opaque non-branded endpoint for a 1M-install VPN; no threat-intel clearance available.

Evidence

• privacy_policy_generic_google store Privacy URL points to myaccount.google.com/privacypolicy — Google's own policy, not scoped to VPNLY; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; redirects user on uninstall to undisclosed 3rd-party URL.
• high_permissions_proxy_management manifest proxy + webRequest + webRequestAuthProvider + management + <all_urls>; management is not justified for a VPN.
• external_host_kurva_cc crx js_external_hosts includes api.kurva.cc — opaque domain with no brand association for a 1M-install VPN.
• verified_publisher store verified_publisher=true; -1.0 discount applied to reputation (not full -3.0 due to capability gate: proxy+webRequest are HIGH-impact).
• install_count_1m store 1,000,000 installs; +1.0+1.0+0.5 webstore reach; broad blast radius.
• justified_broad_permission_discount manifest Category=VPN; -1.5 justified-broad-permission discount applied to permissions pillar for proxy+webRequest+<all_urls>.
• cve_clean crx cve_findings_raw=[] and code_findings_raw=[]; no JS libraries detected; obfuscation_score=0.0.

Permissions Breakdown

• proxy high Can route all browser traffic through attacker-controlled server; core VPN function but very high-impact.
• webRequest high Intercepts all HTTP/S requests across all URLs; combined with proxy creates full traffic visibility.
• webRequestAuthProvider high Can handle authentication credentials for network requests; credential exposure risk.
• management high Can list, enable, disable, or uninstall other extensions; elevated lateral capability.
• tabs medium Accesses tab URLs, titles, and navigation events across all browser tabs.
• storage low Local key-value storage; standard for settings persistence.
• offscreen low Creates offscreen documents for background processing; minimal direct risk.
• <all_urls> high Broad host access paired with proxy+webRequest; ×1.2 amplifier applies.

Pillar Scores

Scoring History

Bookkeeping