Top Risks

• proxy permission routes ALL browser traffic through cloudmask.space / myxavpn.pro — unknown operator with no verifiable identity
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case disclosure
• install_url_hijack opens cloudmask.space on install; JS external hosts include Telegram (t.me) and suspicious domains
• No developer name, email, or verifiable identity; no verified publisher badge; title field empty in store listing
• JS contacts NL+RU hosted servers (app.myxavpn.pro, cloudmask.space) with no audit trail — high interception risk

Evidence

• proxy_permission manifest proxy declared — full browser traffic redirection capability through operator-controlled infrastructure
• install_url_hijack crx onInstalled opens https://cloudmask.space/ — third-party domain unrelated to any verifiable developer identity
• js_external_hosts crx External JS hosts: app.myxavpn.pro, cloudmask.space, t.me — Telegram endpoint unusual for a VPN
• privacy_policy_generic store PP is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy
• no_developer_identity store developer_name, developer_email, and store title all empty; verified_publisher=false; is_featured=false
• geo_diversity api JS hosts span NL and RU — dual-jurisdiction hosting with no transparency about traffic handling
• no_csp manifest csp_present=false on MV3 extension; no content_security_policy declared
• no_maintenance_data store last_updated and months_since_update are null — maintenance pillar scored 0 (no evidence of abandonment)

Permissions Breakdown

• proxy high Full proxy control — routes all browser traffic through attacker-controlled servers; critical capability for a VPN.

Pillar Scores

Bookkeeping