Top Risks

• proxy permission routes all browser traffic through usachvpn.su (.su = Soviet Union ccTLD, opaque jurisdiction).
• Privacy policy is Google's generic policy — does not scope data collection to this extension at all; classified as admitting collection+3rd-party sharing without extension scope → Privacy pillar 10.
• Developer is anonymous (no name, free Gmail), small install count with high-impact permission flags install_perm_anomaly.
• install_url_hijack=true: extension opens an external URL on install, classic monetization/tracking vector.
• No CSP on MV3 is less critical but extension contacts single foreign (.su) JS host with no transparency.

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; VPN category partially justifies but anonymous dev + .su host amplifies risk.
• install_url_hijack crx install_url_hijack=true; extension fires external URL on install — tracking/monetization vector.
• js_external_host_su crx js_external_hosts=['usachvpn.su']; .su ccTLD with single RU-geolocated host, opaque operator.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy=10.
• anonymous_developer store developer_name empty, free Gmail (sedatkilli87@gmail.com), not verified publisher, not featured.
• small_install_high_perm api 85 installs with proxy (HIGH-tier) permission — tail attack surface anomaly flagged.
• host_geo_diversity crx Single JS host country: RU. Low diversity but all infra in Russia.
• no_cve_findings crx cve_findings_raw empty; no library CVEs detected.

Permissions Breakdown

• proxy high Allows full routing of browser traffic through attacker-controlled SOCKS5 servers; high-impact capability.

Pillar Scores

Bookkeeping