Top Risks

• proxy permission lets developer silently reroute ALL browser traffic to attacker-controlled servers
• Developer is anonymous: free Gmail, no name, no verified publisher — classic disposable identity
• Privacy policy is Google's own generic policy — not scoped to this extension at all (v3.5 D: fetched+scope_false+data_collection+3rd_party → +10.0)
• Only 86 installs with a high-tier permission — small-install/high-perm anomaly flagged
• Manifest description in Russian only; extension name mimics legitimate Urban VPN brand — brand-trust exploitation

Evidence

• proxy_permission manifest proxy declared — reroutes all browser traffic; highest-risk VPN-impostor capability.
• free_webmail_no_dev_name store Developer email bubpharxdketu@gmail.com, developer_name empty — anonymous disposable identity.
• generic_google_privacy_policy store Privacy policy URL points to Google's own policy page, not scoped to this extension at all.
• privacy_policy_classification_d api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• small_install_high_perm api 86 installs + proxy permission flagged as install_perm_anomaly.small_install_high_perm=true.
• no_verified_publisher_no_featured store Neither verified publisher nor featured by Google; no reputation anchors.
• russian_description_mismatch manifest Description entirely in Russian; title claims 'Urban VPN' — possible brand-name squatting.
• mv3_no_csp manifest MV3 with csp_present=false; no additional network penalty for MV3 per rubric but proxy remains high risk.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through arbitrary proxy servers — critical capability for a VPN impostor.

Pillar Scores

Bookkeeping