Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Blanc ВПН-Для офиса и работы [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/redirection through any server including silashield.space (RU-hosted unknown domain)
• Privacy policy is Google's own policy — completely unscoped to this extension; admits collection and 3rd-party sharing
• Free-webmail developer (kameqoko032@gmail.com), no developer name, no business website — unverifiable identity
• install_url_hijack == true: extension opens 3rd-party URL on install

Evidence

• proxy_permission manifest proxy declared — can reroute all browser TCP through any host including silashield.space
• install_url_hijack store install_url_hijack=true; extension opens 3rd-party URL on installation
• external_hosts_unknown crx JS contacts app.myxavpn.pro, silashield.space, t.me — unverified domains not in host_permissions
• privacy_policy_generic_google store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_no_devname store Developer email kameqoko032@gmail.com; developer_name empty; no verifiable business identity
• geo_diversity_4_countries api JS hosts span CA, NL, RU, US — 4 countries for a 33-install VPN raises infrastructure concerns
• small_install_high_perm store install_perm_anomaly: 33 installs + proxy (HIGH-tier) = tail attack surface
• no_csp manifest csp_present=false on MV3; v2 +2.0 Network penalty applied
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Blanc ВПН-Для офиса и работы [browser-hijack] + malext.io malicious_extension_sentry; score 5.74 -> 8.24 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled servers.
• https://cloudflare-dns.com/* medium DoH endpoint — expected for VPN DNS resolution but still a network reach.
• https://dns.google/* medium DoH endpoint — expected for VPN DNS resolution but still a network reach.

Pillar Scores

Bookkeeping