Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — vpn-bez-logov [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows all browser traffic redirection to skorostvpn.space — unknown Russian-hosted backend.
• Install URL hijack opens skorostvpn.space on install; third-party domain with RU geo exposure.
• Privacy policy is Google's generic policy — does not scope to this extension; data collection admitted but unrelated.
• Free-webmail developer (gmail), no developer name, no business website — unverifiable identity.

Evidence

• proxy_permission manifest Extension declares 'proxy' — can reroute all Chrome traffic through any server it chooses.
• install_url_hijack crx onInstalled opens https://skorostvpn.space/ — third-party domain, RU-geolocated JS host.
• generic_privacy_policy store Privacy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer silviaferr79@gmail.com, no developer_name set, no business domain — unverifiable.
• skorostvpn_space_js_host crx js_external_hosts includes skorostvpn.space (RU geo) alongside cloudflare-dns.com and dns.google.
• host_geo_diversity api JS hosts span CA, RU, US — 3 countries; RU-hosted backend for a proxy extension is elevated risk.
• install_perm_anomaly api 3 installs + proxy (HIGH-tier) — small_install_high_perm=true; tail-attack-surface confirmed.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — vpn-bez-logov [browser-hijack] + malext.io malicious_extension_sentry; score 5.57 -> 8.07 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control: can redirect all browser traffic through attacker-controlled servers.
• https://cloudflare-dns.com/* medium Host permission to DoH resolver; expected for VPN/DNS-routing but broadens network reach.
• https://dns.google/* medium Host permission to Google DoH; expected but allows DNS resolution exfiltration.

Pillar Scores

Bookkeeping