Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — VPN Hidden [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission grants full traffic redirection capability to unverified gmail developer with no business identity.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack redirects to routekeeper.space on install; extension contacts app.myxavpn.pro and t.me externally.
• Developer is free-webmail with no name, no verified publisher status, and no business domain.

Evidence

• proxy_permission manifest proxy declared — can reroute all browser traffic; HIGH risk for unverified VPN.
• install_url_hijack crx install_url_hijack=true; target=https://routekeeper.space/ on extension install.
• free_webmail_no_dev_name store developer_email=milumepid39@gmail.com; developer_name empty; no business website.
• generic_google_privacy_policy api Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts_include_myxavpn_and_telegram crx js_external_hosts includes app.myxavpn.pro and t.me — not listed in manifest host_permissions.
• geo_diversity_russia api JS hosts span CA, NL, RU, US (4 countries); RU-geolocated endpoint flagged for VPN with 158 installs.
• small_install_high_perm_anomaly api install_perm_anomaly: small_install_high_perm=true; 158 installs with proxy permission.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — VPN Hidden [browser-hijack] + malext.io malicious_extension_sentry; score 4.46 -> 6.96 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-chosen servers.
• https://routekeeper.space/* high Unknown third-party domain; used as install hijack target and proxy backend.
• https://cloudflare-dns.com/* low Legitimate public DNS-over-HTTPS endpoint; plausible for VPN DNS resolution.
• https://dns.google/* low Legitimate Google DNS-over-HTTPS; plausible for VPN DNS resolution.

Pillar Scores

Bookkeeping