Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Amnezia Proxy [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through extension-controlled servers (app.myxavpn.pro, silashield.space)
• Free webmail dev (gmail) with no developer name — unverifiable identity behind a traffic-intercepting extension
• Privacy policy is generic Google account policy, completely unscoped to this extension; admits data collection and 3rd-party sharing
• 29 installs + high-impact proxy permission = tail attack surface with minimal accountability

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser HTTP/HTTPS traffic through developer-controlled endpoints.
• external_js_hosts crx Contacts app.myxavpn.pro, silashield.space, t.me — two unknown/unvetted domains plus Telegram.
• free_webmail_no_devname store Developer email kameqoko032@gmail.com, no developer name provided — anonymous proxy operator.
• privacy_policy_generic store Privacy policy URL is Google's own account policy; scope_extension=false, admits data_collection and third_party_sharing.
• small_install_high_perm api install_perm_anomaly: 29 installs with proxy (HIGH tier) — tail attack surface flag raised.
• host_geo_diversity crx JS hosts span NL and RU — cross-jurisdiction traffic routing concern for a proxy extension.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit CSP declared.
• operator_cluster api sibling_count=0; fingerprint ties gmail account to myxavpn.pro and silashield.space domains.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Amnezia Proxy [browser-hijack] + malext.io malicious_extension_sentry; score 4.49 -> 6.99 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows redirecting all browser traffic through attacker-controlled servers; critical capability.

Pillar Scores

Bookkeeping