Top Risks

• proxy permission routes ALL browser traffic through skorostvpn.space — full MITM capability with 30 installs, zero accountability
• install_url_hijack opens skorostvpn.space on install — likely traffic monetization or malware landing page
• Privacy policy is Google's own generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — admits data sharing not scoped to this extension
• Developer is free-webmail Gmail with no name, no verified publisher, no business domain — anonymous operator
• External JS hosts include skorostvpn.space (unknown Russian-hosted domain) alongside DNS-over-HTTPS providers

Evidence

• proxy_permission manifest proxy declared — redirects all browser network traffic through operator-controlled infrastructure (skorostvpn.space).
• install_url_hijack crx install_url_target=https://skorostvpn.space/ opened on install; 3rd-party monetization/landing page redirect.
• external_host_skorostvpn crx js_external_hosts includes skorostvpn.space — geo CA/RU/US; RU-hosted unknown domain contacts proxy backend.
• generic_google_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• anonymous_developer store developer_name empty, free webmail milumepid39@gmail.com, no verified publisher, no business domain.
• small_install_high_perm api Only 30 installs with proxy (HIGH-tier) permission — tail attack surface anomaly flagged.
• no_csp manifest content_security_policy null / csp_present=false on MV3 extension with external host contacts.
• hoxx_vpn_name_clone store Title mimics established 'Hoxx VPN' brand but is unverified; brand_mention.is_impersonation=false per classifier.

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled server; critical capability for MITM attacks.

Pillar Scores

Bookkeeping