Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Paper VPN — стабильный маршрут [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission grants full traffic redirection capability over all browser connections
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no verified publisher — anonymous, unaccountable operator
• Install URL hijack opens bezopasnet.space on install; extension contacts app.myxavpn.pro and t.me externally

Evidence

• proxy_permission manifest proxy declared — full control over browser network routing, highest-risk single permission for a VPN extension.
• install_url_hijack store onInstalled opens https://bezopasnet.space/ — third-party domain, potential tracking/ad redirect.
• external_js_hosts crx JS contacts app.myxavpn.pro, bezopasnet.space, t.me — two unknown domains plus Telegram.
• generic_privacy_policy store Privacy policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store No developer name, free-webmail email kameqoko032@gmail.com, no verified publisher badge.
• small_install_high_perm api 118 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• geo_diversity api JS hosts span NL and RU (2 countries); RU-based infrastructure for a VPN warrants scrutiny.
• no_csp manifest content_security_policy is null; MV3 provides strict defaults but no explicit CSP declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Paper VPN — стабильный маршрут [browser-hijack] + malext.io malicious_extension_sentry; score 5.34 -> 7.84 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control over all browser traffic; can intercept and redirect any connection.

Pillar Scores

Bookkeeping