Top Risks

• proxy permission routes all browser traffic; VPN from unknown free-webmail dev with no verified identity is maximum trust risk.
• Install URL hijack to nimbusshield.space: onInstalled opens 3rd-party URL, monetization/tracking shape.
• Privacy policy is Google's own generic policy — entirely unscoped to this extension, admits data collection and 3rd-party sharing.
• JS external hosts include app.myxavpn.pro and nimbusshield.space (RU/NL infra), suggesting proxy infra under unknown operator control.
• No developer name, free-webmail Gmail account, no verified publisher — zero accountability for a credential-intercept-capable extension.

Evidence

• install_url_hijack crx onInstalled opens https://nimbusshield.space/ — 3rd-party URL hijack on install.
• free_webmail_dev_no_name store Developer email chatlak4512@gmail.com with no developer name and no business website.
• privacy_policy_generic_google store Privacy policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• proxy_permission manifest proxy declared — intercepts and redirects all browser HTTP/S traffic through extension-controlled servers.
• js_external_hosts_ru_nl crx External JS hosts: app.myxavpn.pro, nimbusshield.space (NL+RU geo), t.me — unknown operator infra.
• small_install_high_perm store Only 240 installs with HIGH-tier proxy permission — tail-attack-surface anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.
• no_verified_publisher store Not verified, not featured; no organizational accountability for a proxy/VPN extension.

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled servers; extremely high capability for interception.

Pillar Scores

Bookkeeping