Top Risks

• proxy permission routes all browser traffic through attacker-controlled endpoints (securepulse.space, app.myxavpn.pro)
• install_url_hijack opens securepulse.space on install — classic malware/adware callback pattern
• Free webmail dev (gmail), no developer name, 3 installs — zero accountability with high-capability permission
• Privacy policy is Google's generic policy — completely unscoped to this extension, admits data collection and third-party sharing
• External JS hosts span NL and RU; securepulse.space domain identity unverifiable; Telegram endpoint (t.me) unusual for VPN

Evidence

• proxy_permission manifest proxy declared — extension can redirect all browser TCP connections to any server it chooses.
• install_url_hijack crx onInstalled opens https://securepulse.space — unknown third-party domain, classic C2/adware callback.
• external_js_hosts crx JS contacts app.myxavpn.pro, securepulse.space, t.me — 3 distinct domains, NL+RU geo, unverified operators.
• free_webmail_no_devname store Developer is norkienej@gmail.com with no developer name — free webmail + anonymous, no accountability.
• generic_google_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy) — not scoped to this extension at all.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → D rule: +10.0.
• install_perm_anomaly api 3 installs + proxy (HIGH-tier): small_install_high_perm=true — tail attack surface with maximum traffic capability.
• no_csp manifest csp_present=false on MV3 extension contacting remote hosts — no script-src restriction in place.

Permissions Breakdown

• proxy high Full proxy control: can redirect all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping