Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Whale VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission gives full network routing control to unknown gmail developer with no verified identity
• Install URL hijack opens nimbusshield.space on install — unknown third-party domain, exfil/tracking risk
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and third-party sharing
• External JS hosts include app.myxavpn.pro and nimbusshield.space (RU/NL geo) — opaque proxy backend

Evidence

• install_url_hijack crx onInstalled opens https://nimbusshield.space/ — third-party domain redirect on install.
• proxy_permission manifest proxy declared — can intercept and reroute all browser traffic to arbitrary servers.
• external_js_hosts crx Contacts app.myxavpn.pro, nimbusshield.space, t.me — opaque VPN backend with Telegram endpoint.
• privacy_policy_generic store Policy URL is Google's own policy page, not extension-specific; scope_extension=false, admits 3rd-party sharing.
• free_webmail_dev_no_name store Developer oveyila408@gmail.com, no developer name, no verified publisher, no business website.
• host_geo_diversity api JS hosts span NL and RU — two countries including Russia for a proxy extension.
• small_install_high_perm store Only 58 installs with proxy (HIGH) permission — tail attack surface anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 mitigates but no explicit CSP declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Whale VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.76 -> 8.26 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full control of browser proxy/network routing; can intercept or redirect all traffic.

Pillar Scores

Bookkeeping