Top Risks

• proxy permission routes all browser traffic through gusenvpn.online (unknown RU-hosted server), enabling full MITM.
• Instagram brand impersonation by unverified free-webmail developer with no developer name.
• Privacy policy is Google's own policy (not scoped to this extension), admitting data collection and third-party sharing.
• Install URL hijack opens gusenvpn.online on installation — classic monetization/tracking redirect.
• No CSP on MV3 extension with proxy permission and external JS host (gusenvpn.online).

Evidence

• proxy_permission manifest proxy declared — full browser traffic reroutable to gusenvpn.online (RU-hosted).
• install_url_hijack store install_url_hijack=true; target=https://gusenvpn.online — opens 3rd-party on install.
• brand_impersonation store brand_mention.is_impersonation=true for 'instagram'; developer is not confirmed Instagram owner.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email oveyila408@gmail.com; developer_name empty; no business identity.
• small_install_high_perm api install_perm_anomaly: 132 installs + proxy (HIGH) — tail attack surface.
• js_external_host crx js_external_hosts=[gusenvpn.online]; RU-hosted, unknown operator.
• no_csp manifest csp_present=false on MV3 extension with external JS host and proxy capability.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers, enabling MITM and traffic inspection.

Pillar Scores

Bookkeeping