Top Risks

• proxy permission routes ALL browser traffic through developer-controlled infrastructure (skorostprdo.space, RU-hosted).
• Privacy policy is Google's generic policy — not scoped to this extension; data_collection and third_party_sharing both true.
• Free-webmail developer (Gmail) with no developer name and no verifiable business identity.
• install_url_hijack triggered: extension opens a third-party URL on install.
• JS contacts skorostprdo.space (RU-hosted domain) — unknown operator controlling VPN endpoints.

Evidence

• proxy_permission manifest proxy declared — can silently redirect all browser traffic to any server.
• js_external_host crx skorostprdo.space (RU, 1 country) contacted by extension JS — unknown operator.
• install_url_hijack crx install_url_hijack=true; extension opens external URL on install.
• generic_privacy_policy store Policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email maks.osokin2056@Gmail.com, developer_name empty, no verified publisher.
• small_install_high_perm api 84 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• cve_findings crx No CVE findings detected; cve_findings_raw empty.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; extremely high abuse potential.
• storage low Local key-value store; low standalone risk.

Pillar Scores

Bookkeeping