Top Risks

• proxy permission routes ALL browser traffic through zhukvpn.online (RU-hosted) — unknown operator.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail Gmail dev, no developer name, no verified publisher — zero accountability.
• Only 12 installs with a HIGH-tier permission (proxy) — tail attack surface / supply-chain risk.
• External JS host zhukvpn.online is Russia-hosted; no transparency on infrastructure.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to zhukvpn.online (RU).
• external_js_host crx js_external_hosts: [zhukvpn.online] — single RU-based endpoint, unknown operator.
• generic_privacy_policy store Privacy policy points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store dev email kameqoko032@gmail.com, developer_name empty, no verified publisher, no featured badge.
• small_install_high_perm api 12 installs with proxy permission flagged by install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 provides default but no custom hardening present.
• geo_diversity api All JS external hosts resolve to RU — single-country, Russia-hosted VPN infrastructure.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.

Permissions Breakdown

• proxy high Full proxy control routes all browser traffic through attacker-controlled infrastructure.

Pillar Scores

Bookkeeping