Top Risks

• proxy permission grants full traffic redirection capability with no host_permissions restriction; unknown third-party operator
• install URL hijack opens horizonguard.space — unknown third-party domain unrelated to any declared VPN brand
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension at all
• Developer uses free Gmail address with no developer name or verified publisher status; extremely low install count (276) with HIGH-perm creates tail-attack-surface risk
• JS external hosts include app.myxavpn.pro and horizonguard.space — two opaque domains with RU/NL geo diversity suggesting non-transparent backend

Evidence

• proxy_permission manifest proxy declared; allows full rerouting of all browser requests through attacker-controlled infrastructure.
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — a third-party domain not matching any recognized VPN brand.
• js_external_hosts crx Extension contacts app.myxavpn.pro, horizonguard.space, t.me — three distinct domains including RU-hosted infra.
• privacy_policy_not_scoped store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true per classification.
• free_webmail_no_dev_name store Developer email is namikkm13@gmail.com with empty developer_name; no verified publisher; unverifiable identity.
• small_install_high_perm api 276 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity crx JS hosts span NL and RU (2 countries); RU-hosted backend for a VPN adds jurisdictional risk.
• no_csp manifest content_security_policy is null; MV3 provides some default protection but no explicit CSP is declared.

Permissions Breakdown

• proxy high Full proxy control can intercept/redirect all browser traffic; core VPN capability but extremely powerful.

Pillar Scores

Bookkeeping