Top Risks

• proxy permission routes ALL browser traffic through skorostvpn.space — unknown Russian operator with gmail dev email
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and third-party sharing
• install_url_hijack opens skorostvpn.space on install — classic traffic-monetization/phishing funnel
• Free-webmail dev (milumepid39@gmail.com), no developer name, no verified publisher — zero accountability
• Only 20 installs with proxy permission and Russian-hosted endpoint — tail-attack-surface red flag

Evidence

• proxy_permission manifest proxy declared — can redirect all browser TCP connections to skorostvpn.space (RU-hosted).
• install_url_hijack manifest onInstalled opens https://skorostvpn.space/ — monetization/phishing funnel pattern.
• external_host_ru crx js_external_hosts includes skorostvpn.space (RU geo); also contacts cloudflare-dns.com and dns.google.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email milumepid39@gmail.com; developer_name empty; no verified publisher badge.
• small_install_high_perm api install_perm_anomaly: 20 installs + proxy (HIGH-tier) — tail-attack-surface confirmed.
• geo_diversity crx JS hosts span CA, RU, US (3 countries); RU presence for a proxy/VPN tool is elevated risk.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• proxy high Allows routing all browser traffic through attacker-controlled server; highest-impact single permission.

Pillar Scores

Bookkeeping