Top Risks

• proxy permission routes ALL browser traffic through zagryzkprd.space (RU-hosted unknown server) — complete traffic interception risk.
• Brand impersonation: mentions YouTube without being affiliated; developer is unverified Gmail user with no business identity.
• Privacy policy is Google's own generic policy — not scoped to this extension; admits data collection & third-party sharing.
• install_url_hijack=true: extension opens 3rd-party URL on install, suggesting monetization or redirect abuse.
• Small install count (134) + high-tier proxy permission = classic tail-attack-surface for targeted credential harvesting.

Evidence

• proxy_permission manifest proxy declared; all browser traffic routable through zagryzkprd.space (RU geo) — unverified operator.
• install_url_hijack store install_url_hijack=true; extension opens 3rd-party URL on install, monetization/redirect indicator.
• external_host_ru crx js_external_hosts: [zagryzkprd.space], geo=RU, unknown registrant, no bad-host hit but suspicious.
• brand_impersonation store YouTube mentioned in description; developer not confirmed owner; is_impersonation=true.
• generic_privacy_policy api Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store dev email maks.osokin2061@Gmail.com; developer_name empty; no business identity verifiable.
• small_install_high_perm api 134 installs + proxy (HIGH tier) = install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy=null; MV3 defaults apply but no explicit CSP declared.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers — critical for a VPN but very high risk from unknown dev.
• storage low Local key-value storage; low standalone risk.

Pillar Scores

Bookkeeping