Top Risks

• Privacy policy is Google's generic account policy — entirely unscoped to this extension, admits data collection and 3rd-party sharing.
• proxy permission routes all browser traffic through developer-controlled servers; no verified publisher identity.
• install_url_hijack: extension opens a 3rd-party URL on install (install_url_target unknown).
• JS external hosts include app.getmyxa.com (RU/NL geo) and t.me — no business identity to validate these endpoints.
• No developer name, email, or webstore metadata available — completely unidentifiable publisher.

Evidence

• proxy_permission manifest proxy declared; VPN category justified but publisher is unverified and unidentifiable.
• privacy_policy_generic store Policy URL is myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• install_url_hijack crx install_url_hijack=true; extension opens 3rd-party URL on install.
• external_hosts crx JS contacts app.getmyxa.com and t.me; host geo NL+RU; no business identity confirms these.
• no_developer_identity store developer_name, developer_email all empty; no verified publisher; no featured badge.
• manifest_name_mismatch crx Manifest name 'Hola VPN' but store title is empty; possible brand use without verification.
• csp_absent_mv3 manifest csp_present=false on MV3; no v2 penalty applies per rubric but no hardening present.
• maintenance_unknown store months_since_update=null; cannot confirm recency; treated as 6-12mo band for conservatism.

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-chosen endpoints.

Pillar Scores

Bookkeeping