Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Amnezia VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission grants full traffic redirection capability with no host_permissions restriction; unknown third-party operator
• install URL hijack opens horizonguard.space — unknown third-party domain unrelated to any declared VPN brand
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension at all
• Developer uses free Gmail address with no developer name or verified publisher status; extremely low install count (276) with HIGH-perm creates tail-attack-surface risk

Evidence

• proxy_permission manifest proxy declared; allows full rerouting of all browser requests through attacker-controlled infrastructure.
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — a third-party domain not matching any recognized VPN brand.
• js_external_hosts crx Extension contacts app.myxavpn.pro, horizonguard.space, t.me — three distinct domains including RU-hosted infra.
• privacy_policy_not_scoped store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true per classification.
• free_webmail_no_dev_name store Developer email is namikkm13@gmail.com with empty developer_name; no verified publisher; unverifiable identity.
• small_install_high_perm api 276 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity crx JS hosts span NL and RU (2 countries); RU-hosted backend for a VPN adds jurisdictional risk.
• no_csp manifest content_security_policy is null; MV3 provides some default protection but no explicit CSP is declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Amnezia VPN [browser-hijack] + malext.io malicious_extension_sentry; score 3.71 -> 6.21 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control can intercept/redirect all browser traffic; core VPN capability but extremely powerful.

Pillar Scores

Bookkeeping