Top Risks

• proxy permission allows full traffic interception/redirection through neoncloak.space and myxavpn.pro — unknown operators
• Install URL hijack opens neoncloak.space on install; combined with gmail dev and no dev name this is a classic throwaway shell pattern
• Privacy policy is Google's generic policy — does NOT scope to this extension; admits data collection and 3rd-party sharing (v3.5 D: +10.0)
• Free-webmail developer (asdro1905@gmail.com), no developer name, no verified publisher — identity entirely unverifiable
• JS contacts neoncloak.space and app.myxavpn.pro (NL/RU geo); no threat-intel hits but both domains unknown and unvetted

Evidence

• proxy_permission manifest proxy declared; can silently route all browser HTTP/S traffic through operator-controlled endpoints.
• install_url_hijack crx onInstalled opens https://neoncloak.space/ — third-party domain, not developer's own.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_no_dev_name store developer_email=asdro1905@gmail.com, developer_name empty, verified_publisher=false → Reputation floor ≥7.5.
• js_external_hosts crx Extension contacts app.myxavpn.pro, neoncloak.space, t.me — 3 distinct registrable domains including Telegram.
• host_geo_diversity api JS hosts span NL and RU (2 countries); RU-hosted VPN infra raises jurisdiction risk.
• small_install_high_perm store 207 installs with proxy (HIGH-tier) permission; install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 has strict defaults but no explicit CSP declared.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; critical for a VPN shell.

Pillar Scores

Bookkeeping