Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — 1Click Vpn — быстрое подк [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through speedfastinrprdo.space — unvetted Russian-hosted domain.
• install_url_hijack: onInstalled opens speedfastinrprdo.space, a 3rd-party unknown domain.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer is anonymous (no name, free-webmail Gmail address) with no verified publisher status.

Evidence

• install_url_hijack crx onInstalled redirects to https://speedfastinrprdo.space — unknown 3rd-party domain hosted in RU.
• proxy_permission manifest proxy declared; all browser traffic can be tunnelled through attacker-controlled server.
• free_webmail_dev_no_name store Developer email ebucisim46@gmail.com; no developer name; no verified publisher badge.
• generic_privacy_policy store Privacy URL is Google account policy — scope_extension==false, admits data_collection+3rd_party_sharing.
• js_external_host_suspicious crx js_external_hosts includes speedfastinrprdo.space — single RU-geolocated unknown host.
• install_perm_anomaly api 10 installs + high-tier proxy permission flagged as small_install_high_perm==true.
• no_csp manifest content_security_policy is null; csp_present==false on MV3 extension.
• geo_diversity api All JS hosts geolocated to RU only; single-country concentration for a VPN extension.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — 1Click Vpn — быстрое подк [browser-hijack] + malext.io malicious_extension_sentry; score 4.30 -> 6.80 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can reroute all browser traffic through an arbitrary server — critical capability for a VPN claiming extension.
• storage low Stores local extension data; low standalone risk.

Pillar Scores

Bookkeeping