Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — щелк Vpn [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission lets developer silently reroute all browser traffic through skorostvpn.space, a Russia-geolocated host.
• Privacy policy is Google's own generic policy — does not scope data practices to this extension at all (+10.0).
• install_url_hijack opens skorostvpn.space on install; RU-hosted third-party receives install event for 3-install mystery VPN.
• Free-webmail developer (gmail), no developer name, no business website — anonymous operator with high-impact capability.

Evidence

• proxy_permission manifest proxy declared — can redirect all Chrome traffic through any server including skorostvpn.space.
• install_url_hijack manifest onInstalled opens https://skorostvpn.space/ — third-party RU-hosted domain receives install telemetry.
• generic_privacy_policy store Privacy URL is Google account policy (479 KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, email milumepid39@gmail.com (free webmail), no business domain, no verified publisher.
• host_geo_russia api js_external_hosts includes skorostvpn.space; host_geo_diversity countries include RU alongside CA and US.
• install_perm_anomaly api 3 installs + proxy (HIGH-tier) = small_install_high_perm true; sleeper/test pattern for future mass deploy.
• no_csp manifest content_security_policy is null; MV3 mitigates some risk but no explicit CSP declared.
• cve_findings_empty crx No CVEs detected; js_libraries_detected empty; code_findings_raw empty; obfuscation_score 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — щелк Vpn [browser-hijack] + malext.io malicious_extension_sentry; score 5.71 -> 8.21 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can intercept and redirect all browser traffic through attacker-controlled servers.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS host access; consistent with VPN function but enables DNS query inspection.
• https://dns.google/* medium DNS-over-HTTPS host access; consistent with VPN function but enables DNS query inspection.

Pillar Scores

Bookkeeping