Top Risks

• proxy permission allows all browser traffic to be routed through usachvpn.su (RU-hosted server), enabling MITM.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• install_url_hijack opens usachvpn.su on install; free-webmail dev with no developer name or verified identity.
• Tiny install base (28) with HIGH-tier permission is a tail-attack-surface signal.
• Developer is free-webmail only, no business domain, no verified publisher — no accountability for proxy backend.

Evidence

• proxy_permission manifest proxy declared — all browser traffic routable through usachvpn.su (RU).
• install_url_hijack store onInstalled opens https://usachvpn.su/ — 3rd-party RU domain.
• generic_privacy_policy store Policy URL is Google account policy, not scoped to this extension; data_collection+3rd_party_sharing=true.
• free_webmail_no_dev_name store Developer email asdro1905@gmail.com, no developer_name, not verified publisher.
• small_install_high_perm api Only 28 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged.
• js_external_host_ru crx External JS host usachvpn.su resolves to RU geography only.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.

Permissions Breakdown

• proxy high Allows full rerouting of all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping