Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Secure VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission lets unknown developer route ALL browser traffic through securepulse.space/app.myxavpn.pro with no accountability.
• Free-webmail Gmail dev, no developer name, no verified publisher — completely unaccountable operator.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack opens securepulse.space on install — install-time redirect to unknown third-party domain.

Evidence

• proxy_permission manifest proxy declared — full traffic interception; VPN category discount applied but operator identity unverifiable.
• free_webmail_no_dev_name store ekugabezu505@gmail.com, developer_name empty, no verified publisher — reputation floor hit.
• install_url_hijack crx onInstalled opens https://securepulse.space — third-party domain redirect on install.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx Extension contacts app.myxavpn.pro, securepulse.space, t.me — 3 distinct domains including Telegram.
• geo_diversity_RU_NL api JS hosts span NL and RU — 2 countries, Russia-hosted endpoint for a VPN is elevated risk.
• small_install_high_perm store 132 installs + proxy permission: install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 default applies but extension has no explicit CSP declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Secure VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.59 -> 8.09 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled servers; full network interception capability.

Pillar Scores

Bookkeeping