Top Risks

• Install-URL hijack opens gusentun.space (unknown RU-hosted domain) immediately on install — classic malware drop pattern.
• Privacy policy is Google's own policy (google.com/privacypolicy) — completely unscoped to this extension; does not describe what this VPN collects.
• Free-webmail dev (gmail) with no developer name and no business website; unverifiable identity behind a proxy extension.
• proxy permission routes ALL browser traffic; combined with unknown backend (gusentun.space, RU) creates full traffic-interception risk.
• Only 39 installs + HIGH permission (proxy) + no developer identity = classic tail-attack-surface / early-stage credential/traffic harvester profile.

Evidence

• install_url_hijack crx onInstalled opens https://gusentun.space — unknown third-party domain hosted in RU, not affiliated with any known VPN provider.
• privacy_policy_generic store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• free_webmail_no_dev_name store Developer email kristi.tis@gmail.com; developer_name empty; no business domain; unverifiable identity.
• proxy_permission manifest proxy declared — can reroute all browser TCP connections through attacker-controlled server (gusentun.space).
• js_external_host_ru crx js_external_hosts=[gusentun.space]; host_geo_diversity countries=[RU]; single RU-based backend for a VPN extension.
• small_install_high_perm api install_perm_anomaly: 39 installs with HIGH-tier proxy permission — tail-attack-surface pattern confirmed.
• no_csp manifest content_security_policy=null; MV3 strict-default applies but no explicit CSP declared.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no accountability signals.

Permissions Breakdown

• proxy high Can redirect all browser traffic through an arbitrary server; core VPN function but extremely powerful.

Pillar Scores

Bookkeeping