Top Risks

• proxy permission allows full traffic interception/rerouting through potentially hostile Russian-hosted SOCKS5 server (osavpn.su, RU).
• Privacy policy is Google's generic account policy — completely unscoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no developer name, no business website — unverifiable identity.
• External JS host osavpn.su is Russian-hosted and unknown; no CSP to restrict script execution.
• Only 11 installs + high-tier proxy permission = tail attack surface with minimal accountability.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to attacker-controlled SOCKS5 server.
• external_js_host crx js_external_hosts: [osavpn.su] — Russian-hosted endpoint, unknown reputation, no CSP guard.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit script-src restriction.
• generic_privacy_policy store Policy is myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true.
• unverified_freeweb_dev store Developer email aslikap21@gmail.com, developer_name empty, no business domain, not verified publisher.
• small_install_high_perm api install_perm_anomaly: 11 installs + has_high_tier_permission=true; tail attack surface.
• host_geo_diversity crx All JS hosts in RU only; VPN extension routing traffic through single Russian jurisdiction.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — no code-quality red flags found.

Permissions Breakdown

• proxy high Allows full rerouting of all browser traffic; extreme capability for a VPN but highest-risk permission.

Pillar Scores

Bookkeeping