Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Urban VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission lets developer silently reroute ALL browser traffic to attacker-controlled servers
• Developer is anonymous: free Gmail, no name, no verified publisher — classic disposable identity
• Privacy policy is Google's own generic policy — not scoped to this extension at all (v3.5 D: fetched+scope_false+data_collection+3rd_party → +10.0)
• Only 86 installs with a high-tier permission — small-install/high-perm anomaly flagged

Evidence

• proxy_permission manifest proxy declared — reroutes all browser traffic; highest-risk VPN-impostor capability.
• free_webmail_no_dev_name store Developer email bubpharxdketu@gmail.com, developer_name empty — anonymous disposable identity.
• generic_google_privacy_policy store Privacy policy URL points to Google's own policy page, not scoped to this extension at all.
• privacy_policy_classification_d api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• small_install_high_perm api 86 installs + proxy permission flagged as install_perm_anomaly.small_install_high_perm=true.
• no_verified_publisher_no_featured store Neither verified publisher nor featured by Google; no reputation anchors.
• russian_description_mismatch manifest Description entirely in Russian; title claims 'Urban VPN' — possible brand-name squatting.
• mv3_no_csp manifest MV3 with csp_present=false; no additional network penalty for MV3 per rubric but proxy remains high risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Urban VPN [browser-hijack] + malext.io malicious_extension_sentry; score 4.12 -> 6.62 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through arbitrary proxy servers — critical capability for a VPN impostor.

Pillar Scores

Bookkeeping