Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — OneClick VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Proxy permission allows full traffic interception/redirection through unknown servers (app.myxavpn.pro, netroutehub.space).
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous operator.
• install_url_hijack: extension opens external URL on install — behaviour anomalous for a VPN tool.

Evidence

• proxy_permission manifest proxy declared; routes all browser traffic; combined with unknown backend hosts (app.myxavpn.pro, netroutehub.space).
• anonymous_developer store developer_name empty, free-webmail gmail, no verified publisher, no featured badge.
• generic_privacy_policy store Privacy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• install_url_hijack manifest install_url_hijack=true; extension opens external page on install — suspicious for a VPN utility.
• external_hosts_unknown crx js_external_hosts: app.myxavpn.pro, netroutehub.space, t.me — two unknown/unvetted backends, one Telegram.
• geo_diversity api JS hosts span NL and RU (country_count=2); below +1.5 threshold but noteworthy for a proxy tool.
• small_install_high_perm store install_perm_anomaly: 33 installs + proxy permission → tail-attack-surface concern.
• no_csp manifest content_security_policy null; MV3 has strict default but no explicit policy declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — OneClick VPN [browser-hijack] + malext.io malicious_extension_sentry; score 4.89 -> 7.39 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; critical MITM capability.

Pillar Scores

Bookkeeping