Top Risks

• proxy permission allows full traffic redirection through attacker-controlled servers (app.myxavpn.pro, vpnfasters.space, RU/NL hosted)
• install URL hijack opens vpnfasters.space on install — classic monetization/phishing funnel pattern
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing
• Free-webmail Gmail developer with no developer name and no verifiable business identity
• Only 24 installs with a HIGH-tier permission (proxy) — tail-attack-surface anomaly

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser traffic to arbitrary servers.
• install_url_hijack manifest onInstalled opens https://vpnfasters.space/ — third-party redirect on install.
• js_external_hosts crx Contacts app.myxavpn.pro, t.me, vpnfasters.space — two foreign-hosted endpoints (NL, RU).
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store developer_email=namikkm13@gmail.com, developer_name empty, no verified publisher badge.
• small_install_high_perm api install_perm_anomaly: 24 installs with HIGH-tier proxy permission — tail attack surface.
• geo_diversity api JS hosts span NL and RU (country_count=2); RU-hosted VPN proxy raises jurisdiction risk.
• no_csp manifest csp_present=false on MV3; no content_security_policy declared.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping