Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Larva VPN — эволюция сетевой защиты [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through zhukvpn.online (RU-hosted) — unknown operator.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail Gmail dev, no developer name, no verified publisher — zero accountability.
• Only 12 installs with a HIGH-tier permission (proxy) — tail attack surface / supply-chain risk.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to zhukvpn.online (RU).
• external_js_host crx js_external_hosts: [zhukvpn.online] — single RU-based endpoint, unknown operator.
• generic_privacy_policy store Privacy policy points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store dev email kameqoko032@gmail.com, developer_name empty, no verified publisher, no featured badge.
• small_install_high_perm api 12 installs with proxy permission flagged by install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 provides default but no custom hardening present.
• geo_diversity api All JS external hosts resolve to RU — single-country, Russia-hosted VPN infrastructure.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Larva VPN — эволюция сетевой защиты [browser-hijack] + malext.io malicious_extension_sentry; score 5.73 -> 8.23 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control routes all browser traffic through attacker-controlled infrastructure.

Pillar Scores

Bookkeeping