Top Risks

• proxy permission routes ALL browser traffic through sverchvpn.space — unknown Russian-hosted server
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection & 3rd-party sharing
• Developer is anonymous gmail account with no name, no business domain, no verification
• install_url_hijack: onInstalled opens third-party URL; opens surveillance/monetization concern
• Only 31 installs with a HIGH-tier permission — small-install/high-perm tail-attack-surface anomaly

Evidence

• proxy_permission manifest proxy declared — can silently redirect all browser HTTPS/HTTP traffic to sverchvpn.space (RU-hosted)
• external_host crx js_external_hosts: [sverchvpn.space] — sole external JS host, single-country RU, unknown operator
• install_url_hijack store install_url_hijack=true; extension opens a third-party URL on install — monetization/tracking risk
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• developer_anonymous store No developer name; email asdro1905@gmail.com (free webmail, no business domain). Not verified, not featured.
• small_install_high_perm api install_perm_anomaly: 31 installs + proxy permission = elevated supply-chain / test-deploy risk
• no_csp manifest content_security_policy null; MV3 provides baseline but no explicit extension CSP declared
• cve_findings_empty crx No CVEs found in bundled libraries; no obfuscation detected (obfuscation_score=0.0)

Permissions Breakdown

• proxy high Full proxy control — can redirect all browser traffic through attacker-controlled server.

Pillar Scores

Bookkeeping