Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — бесплатный впн Д.Ваня [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission lets dev route ALL browser traffic through skorostvpn.space — a Russian-hosted, unverified server.
• Privacy policy is Google's generic account policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (gmail), no developer name, no verified publisher; classic throwaway-identity pattern.
• install_url_hijack opens skorostvpn.space on install — likely monetization or credential-harvesting landing page.

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all HTTP/HTTPS traffic to any server the developer controls.
• install_url_hijack store onInstalled opens https://skorostvpn.space/ — unverified third-party domain, RU-registered.
• js_external_hosts crx Extension contacts cloudflare-dns.com, dns.google, skorostvpn.space — DoH queries plus proprietary VPN backend.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store Developer email ezagirace763@gmail.com, developer_name empty, no verified publisher badge.
• small_install_high_perm api Only 25 installs but has HIGH-tier proxy permission — tail-attack-surface anomaly flagged.
• host_geo_diversity crx JS hosts span 3 countries (CA, RU, US); RU-hosted VPN backend is elevated interception risk.
• no_csp manifest content_security_policy is null — no CSP protection despite MV3 baseline.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — бесплатный впн Д.Ваня [browser-hijack] + malext.io malicious_extension_sentry; score 4.46 -> 6.96 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping