Top Risks

• proxy permission allows all browser traffic to be routed through an unverified SOCKS5 server with no accountability.
• Privacy policy URL is unreachable (fetch_error); no data handling terms can be verified — treated as no policy.
• Developer is anonymous (no name, free Gmail) with no verified business identity for a sensitive VPN product.
• Install URL hijack opens t.me/myxavpn_bot on install — monetization/data-harvest channel.
• Geo-diversity: JS hosts span 4 countries (CA, FI, NL, US) raising supply-chain and jurisdiction concerns.

Evidence

• proxy_permission manifest proxy declared — capable of silently rerouting all browser HTTP/HTTPS traffic to operator-controlled server.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false (HTTPError); scored as no policy (+10.0 privacy pillar).
• anonymous_developer store developer_name empty, email is free Gmail (ekugabezu505@gmail.com); no verified business identity.
• install_url_hijack manifest onInstalled redirects to https://t.me/myxavpn_bot — Telegram bot, possible data harvest / monetization.
• free_webmail_dev store Gmail dev + no business website + no dev name → Reputation floor 7.5 applied.
• geo_diversity crx JS external hosts span 4 countries (CA, FI, NL, US); +1.5 network pillar for non-VPN context — VPN justified partial.
• no_csp manifest content_security_policy is null (MV3 default strict, no extra penalty, but no explicit hardening).
• cve_findings_raw_empty crx No CVEs detected in bundled libraries; CVE pillar = 0.0.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled server — highest VPN risk.
• storage low Stores local extension state; limited risk in isolation.
• notifications low Can display notifications; low capability risk.

Pillar Scores

Bookkeeping