Top Risks

• proxy permission enables full network traffic interception and rerouting through sverchvpn.space (RU-hosted, unknown operator)
• Privacy policy is Google's own account policy — not scoped to this extension at all; admits data collection and third-party sharing
• Free webmail dev (gmail) with no developer name and no business website; anonymous unaccountable operator
• install_url_hijack: extension opens a URL on install, behavioural monetization signal in a tiny-install VPN
• Only 20 installs with high-risk proxy permission — tail-attack-surface / supply-chain probe risk

Evidence

• proxy_permission manifest proxy declared; VPN category partially justifies but operator is anonymous with single RU-hosted endpoint.
• anonymous_developer store developer_name empty, email is free gmail (ezagirace763@gmail.com), no verified publisher badge.
• generic_privacy_policy store Privacy policy URL is Google account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• install_url_hijack manifest install_url_hijack=true; extension triggers URL open on install — monetization or tracking signal.
• external_host_ru crx js_external_hosts: sverchvpn.space; host_geo_diversity: RU only. Unknown VPN backend operator.
• small_install_high_perm api Only 20 installs with proxy (HIGH) permission flagged as install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null / csp_present=false on MV3 extension.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.

Permissions Breakdown

• proxy high Allows full control of browser network routing; can redirect all traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping