Top Risks

• Proxy permission with free-webmail dev (gmail) and no developer name — proxies all browser traffic to unknown operator.
• Privacy policy is Google's own policy (not scoped to this extension) — data handling completely undisclosed.
• Brand impersonation of AdGuard VPN by anonymous developer with only 10 installs and no verified identity.
• Extension contacts app.getmyxa.com and t.me as external JS hosts — unknown third-party infrastructure.
• install_url_hijack flagged; free-webmail + no dev name = high-reputation risk floor.

Evidence

• proxy_permission manifest Declares 'proxy' — routes all browser traffic; critical capability in hands of unverified free-webmail dev.
• brand_impersonation_risk store Title claims 'AdGuard VPN'; developer is gmail account with no name, no verification. AdGuard confirmed_owner=false.
• free_webmail_no_devname store developer_email=ekugabezu505@gmail.com, developer_name empty. Reputation floor applies.
• privacy_policy_generic store Policy URL is Google account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true. Not scoped to this extension.
• external_js_hosts crx JS external hosts: app.getmyxa.com (unknown), t.me (Telegram). No declared host_permissions for these.
• install_url_hijack store install_url_hijack=true; opens third-party URL on install.
• small_install_high_perm api Only 10 installs with HIGH-tier proxy permission — tail-attack-surface anomaly flagged.
• csp_absent manifest No content_security_policy declared (MV3, so no network penalty, but no CSP guard).

Permissions Breakdown

• proxy high Full control over all browser network traffic; can route traffic through any server.

Pillar Scores

Bookkeeping