Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Аво ВПН [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error — cannot verify data handling; treated as no policy (pillar score 10).
• proxy permission routes all browser traffic; free-webmail developer with no verified identity raises compromise risk.
• Developer email is free Gmail with no name or business identity — unaccountable if extension is sold or misused.
• No developer name listed; free-webmail + missing identity floor keeps reputation pillar elevated.

Evidence

• privacy_policy_fetch_failed api Privacy policy at myxavpn.com/privacy/ returned HTTPError; classified as fetched=false → pillar=10.
• proxy_permission manifest proxy declared — routes all browser traffic; high-impact, matches VPN category so no mismatch penalty.
• free_webmail_developer store Developer email ezagirace763@gmail.com, no developer name, no verified publisher.
• js_external_host crx myxavpn.com is only external JS host; site unreachable so backend operator unverifiable.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0 — no malicious code signals detected.
• no_cve_findings api cve_findings_raw empty; no known-vulnerable libraries bundled.
• maintenance_3_6_months store months_since_update=7 → 6-12 month band → +3.5 maintenance score.
• no_sibling_extensions api operator_cluster sibling_count=0; no cluster risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Аво ВПН [browser-hijack] + malext.io malicious_extension_sentry; score 4.00 -> 6.50 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy; core VPN function but high-impact capability.
• storage low Stores extension settings locally; low inherent risk.

Pillar Scores

Bookkeeping