Top Risks

• proxy permission grants full network interception capability over all browser traffic
• Install-URL hijack opens third-party site horizonguard.space on install — monetization/tracking signal
• External JS hosts include app.myxavpn.pro and horizonguard.space — unknown VPN backends with no transparency
• Privacy policy is Google's generic account policy — does not scope to this extension at all (D rule: +10.0)
• Free-webmail dev (gmail), no developer name, no verified publisher — unaccountable operator

Evidence

• proxy_permission manifest proxy declared — full browser traffic routing control, highest-risk single permission.
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — third-party URL hijack on install.
• external_js_hosts crx app.myxavpn.pro, horizonguard.space, t.me — 3 external hosts including unknown VPN backend.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email oveyila408@gmail.com, no developer name — unverifiable operator identity.
• small_install_high_perm api Only 5 installs with HIGH-tier proxy permission — tail attack surface anomaly.
• geo_diversity crx JS hosted across NL and RU — 2 countries, no VPN-justified diversity.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• proxy high Full control over all browser network traffic; can redirect/intercept any request.

Pillar Scores

Bookkeeping