Top Risks

• proxy permission allows full traffic interception and routing through cipherway.space (RU/NL hosted, unverified operator)
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (v3.5 D: +10.0)
• install_url_hijack opens cipherway.space on install — classic monetization/redirect shell behavior
• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous operator of a traffic-routing extension
• External JS hosts include app.getmyxa.com and t.me alongside cipherway.space — 3 distinct unrelated domains, RU geo node

Evidence

• proxy_permission manifest Single 'proxy' permission declared — can intercept and redirect all browser network traffic.
• install_url_hijack crx onInstalled opens https://cipherway.space/ — third-party redirect on install (+2.0 Webstore).
• generic_google_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• free_webmail_anonymous_dev store Developer email norkienej@gmail.com, no developer name, no verified publisher, no business website.
• external_js_hosts crx JS contacts app.getmyxa.com, cipherway.space, t.me — 3 distinct domains including Telegram and unknown analytics.
• host_geo_diversity api JS hosts span NL and RU — 2 countries; RU-hosted proxy backend raises jurisdiction risk.
• small_install_high_perm api Only 23 installs with high-tier proxy permission — tail attack surface anomaly flagged.
• no_csp manifest content_security_policy is null/absent on MV3 extension; no CSP hardening present.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; highest-impact single permission.

Pillar Scores

Bookkeeping