Top Risks

• proxy permission routes ALL browser traffic through gooreshirprdo.space — anonymous .space domain in RU, high MitM risk.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection & 3rd-party sharing.
• Free-webmail dev (Gmail), no developer name, no verified publisher — unaccountable operator.
• install_url_hijack on install; only 22 installs with high-impact proxy permission is a tail-attack-surface red flag.
• External JS host gooreshirprdo.space is an opaque .space domain with no transparency; single RU-hosted endpoint.

Evidence

• proxy_permission manifest proxy declared — all browser traffic can be redirected through developer-controlled server gooreshirprdo.space.
• external_js_host crx js_external_hosts=[gooreshirprdo.space]; opaque .space TLD, single country RU, no transparency.
• install_url_hijack store install_url_hijack=true; extension opens a URL on install — typical monetization/tracking shell behavior.
• privacy_policy_generic store Privacy URL is Google's global policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store dev email maks.osokin2061@gmail.com; no developer name; free webmail; no verified publisher badge.
• small_install_high_perm api 22 installs + proxy permission; install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest csp_present=false on MV3 extension; no content_security_policy declared.
• geo_diversity api All JS hosted in RU (country_count=1); single-country concentration for a VPN product is unusual.

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled server; highest-impact VPN permission.
• storage low Local key-value storage; low standalone risk.

Pillar Scores

Bookkeeping