Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Оса Стелс — Кибер-щит для браузера [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows complete traffic interception and redirection for all browser activity
• Free webmail dev (gmail), no developer name, no verified publisher — anonymous operator
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing
• External JS hosted on osavpn.su (RU-hosted unknown domain) — potential for remote code injection

Evidence

• proxy permission declared manifest proxy is HIGH-risk; can route all browser traffic through any server the extension designates.
• external JS host: osavpn.su crx JS loaded from osavpn.su (Russia). Unknown domain; no threat-intel hit but unverifiable supply chain.
• developer identity — free webmail, no name store norkienej@gmail.com, no developer_name set, not verified publisher, not featured.
• privacy policy is generic Google policy store myaccount.google.com/privacypolicy: scope_extension=false, data_collection=true, third_party_sharing=true.
• install_perm_anomaly: small_install_high_perm api Only 7 installs with proxy (HIGH-tier). Tail-attack-surface risk.
• no CSP defined manifest csp_present=false; MV3 provides some default protection but extension lacks explicit CSP.
• host geo: Russia only crx All JS external hosts geolocate to RU; combined with proxy permission raises interception risk.
• no code findings / obfuscation crx code_findings_raw empty, obfuscation_score=0.0; static scan clean but external host limits confidence.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Оса Стелс — Кибер-щит для браузера [browser-hijack] + malext.io malicious_extension_sentry; score 6.05 -> 8.55 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic to attacker-controlled servers.

Pillar Scores

Bookkeeping