Top Risks

• proxy permission routes all browser traffic through zhukvpn.online (RU-hosted), enabling full MITM interception
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Developer is anonymous free-webmail (gmail), no dev name, no verified publisher status
• Sole external JS host zhukvpn.online is Russia-geolocated; domain identity unverifiable
• 3 installs with HIGH-tier proxy permission is a tail-attack-surface red flag

Evidence

• proxy_permission manifest proxy declared — can route all browser traffic to zhukvpn.online without user per-request consent.
• external_js_host_ru crx js_external_hosts: [zhukvpn.online]; host_geo_diversity countries: [RU] — sole infrastructure in Russia.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_admits_collection_sharing api policy classification: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) → +10.0.
• anonymous_developer store developer_name empty, free-webmail email ekugabezu505@gmail.com, no verified publisher badge.
• install_perm_anomaly api installs=3 with high-tier permission (proxy); small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; static analysis surface clean but proxy capability is self-sufficient.

Permissions Breakdown

• proxy high Redirects all browser traffic through arbitrary SOCKS5 server; full network interception capability.

Pillar Scores

Bookkeeping