Top Risks

• proxy permission routes ALL browser traffic through sverchvpn.space — a Russian-hosted, unvetted domain
• Install URL hijack opens sverchvpn.space on install — classic drive-by monetization / phishing vector
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection & 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• Only 9 installs with a HIGH-tier permission — tail-attack-surface / test-deployment pattern

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability; all browser requests can be redirected to sverchvpn.space.
• install_url_hijack crx onInstalled opens https://sverchvpn.space/ — 3rd-party site, potential phishing / affiliate redirect.
• js_external_host crx External JS host: sverchvpn.space (RU geo). Single-country RU hosting for a VPN raises interception risk.
• privacy_policy_generic store Policy URL is Google's own privacy page — scope_extension=false, data_collection=true, third_party_sharing=true. Score +10.
• free_webmail_no_name store Developer email egositburak@gmail.com, no developer name, no verified publisher, no business website.
• small_install_high_perm api install_perm_anomaly: 9 installs with HIGH-tier proxy permission — tail-attack-surface pattern.
• no_csp manifest content_security_policy is null (csp_present=false). MV3 default applies but no explicit CSP hardening.
• cve_findings_empty crx No CVEs detected; no JS libraries bundled. CVE pillar 0.0.

Permissions Breakdown

• proxy high Full proxy control — routes all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping