Top Risks

• proxy permission routes ALL browser traffic through usachvpn.su (RU-hosted), a developer-controlled SOCKS5 server with no accountability.
• Developer is free-webmail (gmail) with no name, no verified publisher status, and a Google generic privacy policy that does not scope this extension.
• Privacy policy is Google's own policy — not scoped to this extension — yet extension admits data collection and third-party sharing (D rule: +10.0).
• install_url_hijack=true: onInstalled opens a third-party URL, classic monetization/tracking shell behaviour.
• small_install + HIGH-perm anomaly (22 installs, proxy permission): tail-attack-surface vector.

Evidence

• proxy_permission manifest proxy declared; routes entire browser through usachvpn.su — RU-only geo, no verified publisher.
• js_external_host crx usachvpn.su is the sole external JS host; single-country (RU), no bad-host hit but unverifiable.
• install_url_hijack store install_url_hijack=true; opens 3rd-party URL on install — Webstore +2.0.
• privacy_policy_generic store Policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) → Privacy pillar +10.0 per rule D.
• free_webmail_no_dev_name store silviaferr79@gmail.com, developer_name='', not verified, not featured → Reputation floor >=7.5.
• install_perm_anomaly api 22 installs + proxy (HIGH) → small_install_high_perm=true (+1.5 Webstore).
• csp_absent_mv3 manifest csp_present=false; MV3 strict default applies so no +2.0 MV2 penalty, but no CSP noted.
• no_cve_findings crx cve_findings_raw=[] and js_libraries_detected=[] — CVE pillar 0.0.

Permissions Breakdown

• proxy high Full browser proxy control; can redirect all traffic through attacker-controlled SOCKS5 server (usachvpn.su).

Pillar Scores

Bookkeeping