Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Prime VPN – премиальный proxy с быстрым стартом [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through sverchvpn.space — a Russian-hosted, unvetted domain
• Install URL hijack opens sverchvpn.space on install — classic drive-by monetization / phishing vector
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection & 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability; all browser requests can be redirected to sverchvpn.space.
• install_url_hijack crx onInstalled opens https://sverchvpn.space/ — 3rd-party site, potential phishing / affiliate redirect.
• js_external_host crx External JS host: sverchvpn.space (RU geo). Single-country RU hosting for a VPN raises interception risk.
• privacy_policy_generic store Policy URL is Google's own privacy page — scope_extension=false, data_collection=true, third_party_sharing=true. Score +10.
• free_webmail_no_name store Developer email egositburak@gmail.com, no developer name, no verified publisher, no business website.
• small_install_high_perm api install_perm_anomaly: 9 installs with HIGH-tier proxy permission — tail-attack-surface pattern.
• no_csp manifest content_security_policy is null (csp_present=false). MV3 default applies but no explicit CSP hardening.
• cve_findings_empty crx No CVEs detected; no JS libraries bundled. CVE pillar 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Prime VPN – премиальный proxy с быстрым стартом [browser-hijack] + malext.io malicious_extension_sentry; score 5.68 -> 8.18 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control — routes all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping