Top Risks

• proxy permission routes ALL browser traffic through gusentun.space — unknown Russian operator can intercept/manipulate traffic
• Install URL hijack opens gusentun.space on install; sole external JS host is same domain — supply-chain risk
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and third-party sharing
• Free-webmail dev (gmail), no developer name, no business identity — unaccountable operator
• Only 34 installs with HIGH-tier permission: classic tail-attack-surface / sleeper pattern

Evidence

• proxy_permission manifest proxy declared — entire browser traffic routeable through gusentun.space (RU-hosted)
• install_url_hijack store install_url_target=https://gusentun.space; same domain is sole external JS host
• generic_privacy_policy store Privacy URL points to Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_no_dev_name store developer_email=chatlak4512@gmail.com; developer_name empty; no business identity
• small_install_high_perm api 34 installs with proxy (HIGH-tier); install_perm_anomaly.small_install_high_perm=true
• single_ru_host crx js_external_hosts=[gusentun.space]; host_geo=RU only; VPN backend unverifiable
• mv3_no_csp manifest MV3 has strict default CSP so no penalty; csp_present=false is expected for MV3
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors

Permissions Breakdown

• proxy high Proxy permission allows routing all browser traffic through attacker-controlled server.

Pillar Scores

Bookkeeping