Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• proxy + webRequest + <all_urls>: full traffic interception capability on every site; VPN routing through user1-user11.setupvpn.com servers in IN only.
• Privacy policy admits data collection and third-party sharing with no extension-scoped retention disclosure — scores maximum privacy risk.
• management permission allows disabling/uninstalling other extensions, atypical for a VPN.
• multiple innerHTML DOM-XSS sinks combined with new Function() constructors across 3 bundle files increases exploit surface.

Evidence

• proxy+webRequest+<all_urls> manifest proxy, webRequest, webRequestAuthProvider, and <all_urls> together enable full traffic interception/rerouting.
• management permission manifest management declared — can enumerate and disable other installed extensions; unusual for VPN category.
• privacy policy: data_collection=true, third_party_sharing=true, scope_extension=false, retention=false api Policy admits collection and 3rd-party sharing but does not scope to this extension nor disclose retention.
• function_constructor findings x3 crx new Function() constructor in background.bundle.js, baselink.bundle.js, popup.bundle.js.
• dom_sink_innerhtml_userctrl findings x3 crx innerHTML assignments in baselink.bundle.js, libs/vendors.dll.js, popup.bundle.js — DOM-XSS risk.
• js_external_hosts: 11 user*.setupvpn.com subdomains + github.com crx Extension connects to 12 distinct external hosts; VPN server pool all geolocated to IN.
• no developer_name store Offered-by field empty; developer identity relies solely on email domain setupvpn.com.
• 17 months since update store Last updated January 6 2025; 17 months stale at scoring time — maintenance risk elevated.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers.
• webRequest high Intercept and inspect all HTTP/HTTPS requests across every site.
• webRequestAuthProvider high Can handle and potentially steal proxy/HTTP authentication credentials.
• management high Can enumerate, disable, or uninstall other extensions.
• tabs medium Access tab URLs and navigation events across all sites.
• declarativeNetRequest medium Can block or redirect network requests declaratively.
• notifications medium Can display arbitrary system notifications to user.
• storage low Local extension data storage; low standalone risk.
• alarms low Scheduled background tasks; minimal standalone risk.
• <all_urls> (host_permissions) high Broad host access enables proxy+webRequest to inspect all traffic.

Pillar Scores

Scoring History

Bookkeeping