Top Risks

• proxy permission routes all browser traffic through ironproxy.space/app.myxavpn.pro — unknown operators in NL/RU
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and 3rd-party sharing
• install_url_hijack opens https://ironproxy.space/ on install — classic traffic-monetization pattern
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• Tiny install count (13) with high-impact permission (proxy) signals tail-attack-surface / early-stage malware distribution

Evidence

• proxy_permission manifest proxy declared — extension can silently redirect all HTTP/HTTPS traffic to ironproxy.space or app.myxavpn.pro
• install_url_hijack crx onInstalled opens https://ironproxy.space/ — 3rd-party URL hijack on installation
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10
• free_webmail_no_dev_name store developer_email=ekugabezu505@gmail.com, developer_name empty, no verified publisher, no business site
• js_external_hosts crx Extension contacts app.myxavpn.pro, ironproxy.space (RU/NL), and t.me — 3 distinct registrable domains
• small_install_high_perm api 13 installs + proxy permission = install_perm_anomaly.small_install_high_perm=true; tail-attack-surface
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared
• geo_diversity crx JS hosts span NL and RU (country_count=2); RU-hosted proxy with unknown operator raises interception risk

Permissions Breakdown

• proxy high Allows routing all browser traffic through attacker-controlled server; highest-impact single permission.

Pillar Scores

Bookkeeping