Top Risks

• proxy permission allows full traffic interception/rerouting through unvetted servers (app.myxavpn.pro, silashield.space)
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 privacy)
• YouTube brand impersonation by unverified free-webmail developer with no dev name
• install_url_hijack: onInstalled opens 3rd-party URL; target unknown
• 4-country JS host geo-diversity (CA/NL/RU/US) with unknown silashield.space endpoint

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to arbitrary servers including app.myxavpn.pro and silashield.space
• brand_impersonation store Description claims '4K YouTube VPN'; brand_mention.is_impersonation=true, developer is unverified gmail user
• generic_privacy_policy store Privacy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true
• install_url_hijack crx install_url_hijack=true; onInstalled opens 3rd-party URL (target not captured)
• unknown_external_host crx JS contacts silashield.space and app.myxavpn.pro — unrecognized domains, one with .space TLD
• free_webmail_no_devname store developer_email=aslikap21@gmail.com, developer_name empty, no verified publisher, no business domain
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — includes Russia-hosted endpoint for a VPN
• small_install_high_perm store Only 18 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers.
• https://cloudflare-dns.com/* medium Host permission to DNS-over-HTTPS endpoint; expected for VPN DNS leak prevention.
• https://dns.google/* medium Host permission to Google DNS endpoint; expected for VPN DNS leak prevention.

Pillar Scores

Bookkeeping