Top Risks

• proxy permission lets developer redirect all browser traffic through any server — extreme data-interception risk.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (imawocigi29@gmail.com), no developer name, no verified publisher — zero accountability.
• install_url_hijack: extension opens a third-party URL on install (app.getmyxa.com / t.me contacted externally).
• Only 25 installs with a HIGH-tier permission (proxy) — classic tail-attack-surface fingerprint.

Evidence

• proxy_permission manifest Extension declares 'proxy' — can intercept and reroute all browser HTTP/S traffic to arbitrary servers.
• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_name store Developer email imawocigi29@gmail.com (numbered alias pattern); developer_name is empty; no business domain.
• install_url_hijack crx install_url_hijack=true; js_external_hosts include app.getmyxa.com and t.me — on-install redirect to 3rd-party.
• small_install_high_perm api Only 25 installs with proxy permission flagged by install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity crx JS external hosts span NL and RU — 2 countries; RU-hosted infrastructure for a VPN is elevated risk.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors present.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension — v2 +2.0 network applied.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through arbitrary servers — critical capability for a VPN extension.

Pillar Scores

Bookkeeping