Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Бебра ВПН [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/rerouting through unvetted servers (app.myxavpn.pro, silashield.space)
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 privacy)
• YouTube brand impersonation by unverified free-webmail developer with no dev name
• install_url_hijack: onInstalled opens 3rd-party URL; target unknown

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to arbitrary servers including app.myxavpn.pro and silashield.space
• brand_impersonation store Description claims '4K YouTube VPN'; brand_mention.is_impersonation=true, developer is unverified gmail user
• generic_privacy_policy store Privacy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true
• install_url_hijack crx install_url_hijack=true; onInstalled opens 3rd-party URL (target not captured)
• unknown_external_host crx JS contacts silashield.space and app.myxavpn.pro — unrecognized domains, one with .space TLD
• free_webmail_no_devname store developer_email=aslikap21@gmail.com, developer_name empty, no verified publisher, no business domain
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — includes Russia-hosted endpoint for a VPN
• small_install_high_perm store Only 18 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Бебра ВПН [browser-hijack] + malext.io malicious_extension_sentry; score 5.65 -> 8.15 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers.
• https://cloudflare-dns.com/* medium Host permission to DNS-over-HTTPS endpoint; expected for VPN DNS leak prevention.
• https://dns.google/* medium Host permission to Google DNS endpoint; expected for VPN DNS leak prevention.

Pillar Scores

Bookkeeping