Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Lagom VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through sverchtun.store (RU-hosted), enabling MITM on every site visited
• Install URL hijack opens sverchtun.store on install — unknown third-party site collecting install events
• Privacy policy is Google's own policy, completely unscoped to this extension; admits data collection and 3rd-party sharing
• Free-webmail dev (gmail) with no developer name, no verified publisher, no business website

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic through extension-controlled server at sverchtun.store (RU).
• install_url_hijack store onInstalled opens https://sverchtun.store/ — unknown RU domain, not developer-identified.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_no_devname store Developer email oveyila408@gmail.com; developer_name empty; no verified publisher; no business website.
• js_external_host_ru crx Only JS external host is sverchtun.store, geolocated RU — matches install hijack target.
• install_perm_anomaly api small_install_high_perm=true: 229 installs with proxy (HIGH-tier) permission.
• no_csp manifest csp_present=false; MV3 provides strict default but absence noted with external host contact.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no accountability signals.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Lagom VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.67 -> 8.17 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-controlled servers; highest-impact single permission.

Pillar Scores

Bookkeeping