Top Risks

• proxy permission gives developer full control over all browser network traffic routing.
• Privacy policy URL fetch failed (HTTP error); policy unverifiable and treated as absent.
• Free-webmail dev (gmail) with no developer name and no verified business identity.
• Tiny install base (199) with high-risk permission is a tail-attack-surface signal.
• External JS host myxavpn.com is unresolvable/unknown; no domain age or WHOIS data available.

Evidence

• proxy_permission manifest proxy declared — redirects all browser traffic; core VPN function but extremely high misuse potential.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false, reason=fetch_error:HTTPError; policy URL myxavpn.com/privacy/ unreachable.
• free_webmail_no_dev_name store developer_email=norkienej@gmail.com, developer_name empty; no verified business identity.
• small_install_high_perm api install_perm_anomaly: 199 installs + high-tier proxy permission flagged as tail attack surface.
• external_js_host crx js_external_hosts=[myxavpn.com]; same domain as broken privacy policy; no threat intel data available.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit policy declared.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust signals from Google.
• maintenance_3_6_months store months_since_update=6; borderline stale at 3–6 month threshold (+1.5).

Permissions Breakdown

• proxy high Full control over browser network routing; can redirect all traffic through attacker-controlled servers.
• storage low Local key-value storage; low intrinsic risk.

Pillar Scores

Bookkeeping