Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• proxy + <all_urls> + webRequest: extension routes and observes all browser traffic — highest-impact capability bundle.
• management permission allows enumerating/disabling other installed extensions beyond VPN scope.
• Privacy policy fetch timed out; cannot verify data handling scope or retention commitments.
• new Function() constructor found in permission-manager JS; dynamic code execution risk.

Evidence

• proxy+<all_urls>+webRequest combo manifest Three HIGH permissions together; justified for VPN but represents maximum traffic interception capability.
• management permission manifest Can list/enable/disable other extensions; scope exceeds typical VPN requirements.
• privacy policy fetch failed api fetch_error:ConnectTimeout on tunnelbear.com/privacy-policy; cannot assess scope or retention.
• function_constructor in JS crx new Function() in permission-manager-BzAewfV7.js; dynamic eval risk, obfuscation_score=0.0.
• 12 external JS hosts crx Contacts AWS API Gateway, api.tunnelbear.com, bearsmyip.com, raw.github.com among others.
• no bad/affiliate/monetization hits api threat_intel shows no bad_host_hits, affiliate_hits, or monetization_hits; domain resolves fine.
• MV3 + CSP present manifest script-src self, object-src self; strict CSP mitigates remote code loading risk.
• 1M installs, rating 4.6, no review red flags store High install base, no redirect/malware reviews flagged; 0 operator siblings.

Permissions Breakdown

• proxy high Core VPN function; routes all browser traffic through proxy — very high capability.
• storage low Stores extension settings locally.
• declarativeNetRequest medium Can block/redirect network requests; justified for VPN traffic management.
• webRequest high Observes all HTTP requests; necessary for VPN but broad capability.
• privacy high Modifies browser privacy settings (WebRTC, etc.); expected for VPN leak protection.
• management high Can list/disable other extensions; elevated capability beyond core VPN function.
• webRequestAuthProvider high Handles proxy authentication credentials; sensitive but aligned with proxy permission.
• <all_urls> high Host permission covering all URLs; required for proxy interception across all sites.

Pillar Scores

Scoring History

Bookkeeping