Top Risks

• proxy permission routes ALL browser traffic through attacker-controlled servers with no verified infrastructure
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Developer is anonymous (no name, free-webmail Gmail, no verified domain) for a VPN/proxy handling all traffic
• install_url_hijack detected — extension opens 3rd-party URL on install (app.getmyxa.com referenced as external JS host)
• Tiny install base (109) with HIGH-tier proxy permission = high tail-attack-surface risk

Evidence

• proxy_permission manifest proxy declared — allows rerouting all browser HTTP/S traffic to any server operator controls.
• anonymous_developer store No developer name, free-webmail Gmail (oveyila408@gmail.com), no verified publisher badge.
• generic_privacy_policy store Privacy URL is Google's own account policy — fetched, scope_extension=false, data_collection=true, third_party_sharing=true.
• install_url_hijack crx install_url_hijack=true; extension opens 3rd-party URL on install — onboarding may involve ad-tech at app.getmyxa.com.
• external_js_hosts crx js_external_hosts: app.getmyxa.com (unknown ad/analytics?), t.me (Telegram). 2 distinct external domains.
• small_install_high_perm api install_perm_anomaly: 109 installs with proxy (HIGH-tier). Tail-attack-surface confirmed by anomaly check.
• geo_diversity api JS hosts span NL and RU (country_count=2). RU-hosted proxy infra for a VPN raises jurisdiction risk.
• no_csp manifest csp_present=false on MV3 extension. MV3 has strict default but no explicit policy declared.

Permissions Breakdown

• proxy high Proxy permission allows full rerouting of all browser traffic — maximum network interception capability.

Pillar Scores

Bookkeeping