Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Гусь VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through operator-controlled SOCKS5 servers at usachvpn.su (RU-hosted).
• Privacy policy is Google's generic account policy — does not scope to this extension at all; admits data collection and 3rd-party sharing.
• Developer is free-webmail (gmail), no name, no verified publisher — anonymous operator with high-capability extension.
• install_url_hijack=true: extension opens external URL on install, typical of low-quality monetization shells.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to any server, no host_permissions required.
• external_js_host crx js_external_hosts: [usachvpn.su] — RU-TLD domain; extension contacts this host.
• install_url_hijack store install_url_hijack=true — extension opens 3rd-party URL on install.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true. Score +10.
• free_webmail_no_devname store developer_email=kameqoko032@gmail.com, developer_name empty, no verified_publisher — anonymous operator.
• small_install_high_perm api install_perm_anomaly: 69 installs + has_high_tier_permission=true → tail-attack-surface fingerprint.
• no_csp manifest csp_present=false on MV3 extension; no content_security_policy declared.
• geo_diversity crx JS hosts located only in RU; VPN category — 1 country, no penalty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Гусь VPN [browser-hijack] + malext.io malicious_extension_sentry; score 4.37 -> 6.87 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-controlled SOCKS5 servers.

Pillar Scores

Bookkeeping