Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Чебурашка VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Install-URL hijack opens gusentun.space (unknown RU-hosted domain) immediately on install — classic malware drop pattern.
• Privacy policy is Google's own policy (google.com/privacypolicy) — completely unscoped to this extension; does not describe what this VPN collects.
• Free-webmail dev (gmail) with no developer name and no business website; unverifiable identity behind a proxy extension.
• proxy permission routes ALL browser traffic; combined with unknown backend (gusentun.space, RU) creates full traffic-interception risk.

Evidence

• install_url_hijack crx onInstalled opens https://gusentun.space — unknown third-party domain hosted in RU, not affiliated with any known VPN provider.
• privacy_policy_generic store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• free_webmail_no_dev_name store Developer email kristi.tis@gmail.com; developer_name empty; no business domain; unverifiable identity.
• proxy_permission manifest proxy declared — can reroute all browser TCP connections through attacker-controlled server (gusentun.space).
• js_external_host_ru crx js_external_hosts=[gusentun.space]; host_geo_diversity countries=[RU]; single RU-based backend for a VPN extension.
• small_install_high_perm api install_perm_anomaly: 39 installs with HIGH-tier proxy permission — tail-attack-surface pattern confirmed.
• no_csp manifest content_security_policy=null; MV3 strict-default applies but no explicit CSP declared.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no accountability signals.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Чебурашка VPN [browser-hijack] + malext.io malicious_extension_sentry; score 4.76 -> 7.26 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through an arbitrary server; core VPN function but extremely powerful.

Pillar Scores

Bookkeeping