Top Risks

• proxy permission routes all browser traffic; free-webmail dev with no verified identity or business website
• install_url_hijack opens maskirovka.space on install; extension contacts RU-hosted domains app.myxavpn.pro and maskirovka.space
• Privacy policy is Google's generic policy — does not scope to this extension, admits data collection and third-party sharing
• No developer name, no verified publisher, gmail-only identity — extreme accountability gap for a traffic-interception tool
• Only 11 installs with HIGH-tier proxy permission — classic tail-attack-surface / dropper fingerprint

Evidence

• install_url_hijack crx onInstalled opens https://maskirovka.space — an external Russian-hosted domain unrelated to any VPN service.
• proxy_permission_high_risk manifest proxy declared; can silently redirect all HTTPS traffic through any server including maskirovka.space or app.myxavpn.pro.
• external_hosts_suspicious crx JS contacts app.myxavpn.pro (NL), maskirovka.space (RU), t.me — two non-Google foreign hosts for an 11-install VPN.
• free_webmail_no_dev_name store Developer is norkienej@gmail.com with empty developer_name; no business identity or verified publisher.
• privacy_policy_generic_google store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• install_perm_anomaly api 11 installs + HIGH-tier proxy permission flagged as small_install_high_perm anomaly.
• host_geo_diversity crx JS hosts span NL and RU (country_count=2); RU host maskirovka.space is the install-hijack target.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; central capability for a rogue VPN.

Pillar Scores

Bookkeeping