Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Гусь VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows complete traffic interception with no verifiable infrastructure disclosed
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no business website — identity unverifiable
• No installs or rating data; new obscure extension with powerful network capability

Evidence

• proxy_permission manifest proxy declared — can redirect all Chrome traffic through arbitrary servers with no host restriction disclosed.
• free_webmail_developer store Developer email asdro1905@gmail.com; no developer name; no business website. Identity unverifiable.
• generic_privacy_policy store Privacy policy URL is Google's own account policy (not scoped to extension); scope_extension=false, data_collection=true, third_party_sharing=true.
• no_installs_no_rating store Install count empty, rating 0 — no community signal to assess trustworthiness.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 VPN extension.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• no_code_findings crx code_findings_raw empty; obfuscation_score 0.0; 2 JS files scanned.
• no_bad_hosts api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; no external JS hosts.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Гусь VPN [browser-hijack] + malext.io malicious_extension_sentry; score 2.52 -> 5.02 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Proxy permission allows full routing of browser traffic through attacker-controlled servers; critical capability.

Pillar Scores

Bookkeeping