Top Risks

• proxy permission routes all browser traffic through developer-controlled servers (app.myxavpn.pro, silashield.space) in NL/RU.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Free-webmail developer (asdro1905@gmail.com), no dev name, no business website — no accountability.
• install_url_hijack flagged: onInstalled opens third-party URL, possible traffic capture or phishing.
• Only 9 installs with HIGH-tier permission (proxy) — tail attack surface anomaly.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser HTTP/HTTPS traffic to attacker-controlled endpoints.
• external_hosts crx JS contacts app.myxavpn.pro (NL), silashield.space (RU), t.me — two opaque VPN endpoints plus Telegram.
• install_url_hijack store install_url_hijack=true; onInstalled opens external URL — potential phishing or tracking redirect.
• privacy_policy_generic store Policy URL is Google account policy (479 KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store Developer email asdro1905@gmail.com, no developer name, no business domain — zero accountability.
• small_install_high_perm api Only 9 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span NL and RU (country_count=2); RU-hosted proxy backend raises jurisdiction concern.
• no_csp manifest content_security_policy is null — no CSP hardening on MV3 extension.

Permissions Breakdown

• proxy high Can reroute all browser traffic through an arbitrary server — critical interception capability.

Pillar Scores

Bookkeeping