Top Risks

• proxy permission routes ALL browser traffic through attacker-controlled infra (cloudmask.space, app.myxavpn.pro)
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing
• install_url_hijack opens cloudmask.space on install — monetization/redirect shell pattern
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• JS contacts NL+RU geo-diverse hosts (app.myxavpn.pro, cloudmask.space, t.me) with no CSP

Evidence

• proxy_permission manifest proxy declared; full browser traffic interception possible via cloudmask.space / app.myxavpn.pro.
• install_url_hijack store onInstalled opens https://cloudmask.space/ — unrelated third-party redirect on install.
• generic_privacy_policy api Policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_no_dev_name store Developer email norkienej@gmail.com, developer_name empty, no verified publisher.
• external_js_hosts crx JS contacts app.myxavpn.pro, cloudmask.space, t.me — 3 distinct domains, no CSP constraint.
• geo_diversity api JS hosts in NL and RU (country_count=2); Russian-hosted VPN proxy backend raises interception risk.
• small_install_high_perm store Only 45 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; maximum MITM capability.

Pillar Scores

Bookkeeping