Top Risks

• proxy permission allows routing all browser traffic through sverchvpn.space, an unvetted Russian-hosted server.
• install_url_hijack opens sverchvpn.space on install — classic monetization/tracking shell pattern.
• Google privacy policy used as proxy policy — explicitly excludes this extension's data practices.
• Free-webmail developer (gmail), no dev name, no verified publisher — zero accountability.
• Extremely low install count (4) with high-impact permission signals tail-attack-surface / test deployment.

Evidence

• proxy permission manifest proxy declared — can intercept and redirect all browser network traffic to sverchvpn.space (RU).
• install_url_hijack store onInstalled opens https://sverchvpn.space/ — monetization/tracking redirect pattern.
• generic_google_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store silviaferr79@gmail.com, empty developer_name, no verified publisher, no featured badge.
• js_external_hosts crx External JS host: sverchvpn.space (RU). Extension contacts same domain as install-URL hijack target.
• small_install_high_perm api Only 4 installs with proxy (HIGH) permission — tail attack surface / early-stage deployment.
• host_geo_diversity api Single JS host country: RU. Proxy extension routing traffic to Russian-hosted endpoint.
• csp_absent_mv3 manifest No content_security_policy set; MV3 default applies but no explicit restriction on network scope.

Permissions Breakdown

• proxy high Full control over browser network routing; can redirect all traffic through attacker-controlled server.

Pillar Scores

Bookkeeping