Top Risks

• Brand impersonation of AdGuard VPN by a free-webmail Gmail dev with no verified identity; proxy permission redirects all traffic.
• install_url_hijack confirmed: onInstalled opens neoncloak.space, a suspicious third-party domain also used as a JS external host.
• Privacy policy is Google's own generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — completely unscoped.
• JS communicates with app.myxavpn.pro and neoncloak.space — unknown third-party endpoints for a supposed AdGuard product.
• 58 installs + proxy permission + free-webmail dev + no developer name = classic tail-attack-surface credential-harvesting shell.

Evidence

• brand_impersonation store Title 'Adguard VPN' with Gmail dev (sedatkilli87@gmail.com), no verified publisher, not affiliated with Adguard Software Ltd.
• install_url_hijack crx onInstalled opens https://neoncloak.space/ — same domain appears in js_external_hosts; not AdGuard infrastructure.
• proxy_permission manifest proxy declared; all browser traffic can be intercepted or rerouted by this extension.
• external_js_hosts crx JS contacts app.myxavpn.pro, neoncloak.space, t.me — no AdGuard domains present.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, third_party_sharing=true — not scoped to this extension.
• free_webmail_no_dev_name store developer_name empty, developer_email is Gmail; no verifiable business identity behind high-capability VPN extension.
• small_install_high_perm api 58 installs with HIGH-tier proxy permission flagged by install_perm_anomaly.small_install_high_perm=true.
• geo_diversity crx JS hosted in NL and RU (2 countries); Russian-hosted endpoint for an AdGuard impersonator is notable.

Permissions Breakdown

• proxy high Full proxy control over all browser traffic; can redirect, intercept, or suppress any network request.

Pillar Scores

Scoring History

Bookkeeping