Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Brawl Vpn – быстрый Proxy [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows routing all browser traffic through sverchvpn.space, an unvetted Russian-hosted server.
• install_url_hijack opens sverchvpn.space on install — classic monetization/tracking shell pattern.
• Google privacy policy used as proxy policy — explicitly excludes this extension's data practices.
• Free-webmail developer (gmail), no dev name, no verified publisher — zero accountability.

Evidence

• proxy permission manifest proxy declared — can intercept and redirect all browser network traffic to sverchvpn.space (RU).
• install_url_hijack store onInstalled opens https://sverchvpn.space/ — monetization/tracking redirect pattern.
• generic_google_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store silviaferr79@gmail.com, empty developer_name, no verified publisher, no featured badge.
• js_external_hosts crx External JS host: sverchvpn.space (RU). Extension contacts same domain as install-URL hijack target.
• small_install_high_perm api Only 4 installs with proxy (HIGH) permission — tail attack surface / early-stage deployment.
• host_geo_diversity api Single JS host country: RU. Proxy extension routing traffic to Russian-hosted endpoint.
• csp_absent_mv3 manifest No content_security_policy set; MV3 default applies but no explicit restriction on network scope.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Brawl Vpn – быстрый Proxy [browser-hijack] + malext.io malicious_extension_sentry; score 5.05 -> 7.55 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full control over browser network routing; can redirect all traffic through attacker-controlled server.

Pillar Scores

Bookkeeping