Top Risks

• proxy permission enables full traffic interception/MITM via ironproxy.space (RU-hosted)
• Privacy policy is Google's own generic policy — not scoped to this extension at all
• Install URL hijack opens ironproxy.space on install; unknown third-party domain
• Free-webmail dev (vale99505@gmail.com), no developer name, no verified publisher
• Only 7 installs with HIGH-tier permission (proxy) — classic tail-attack-surface pattern

Evidence

• proxy_permission manifest proxy declared; routes all browser traffic through ironproxy.space (NL/RU hosted).
• install_url_hijack store onInstalled opens https://ironproxy.space/ — unknown third-party domain.
• external_hosts crx JS contacts app.myxavpn.pro, ironproxy.space (RU), t.me — 3 distinct domains.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Free gmail dev email, no developer name, no verified publisher, no featured badge.
• install_perm_anomaly api 7 installs with high-tier proxy permission; small_install_high_perm=true.
• geo_diversity api JS hosts span NL and RU — 2 countries; RU jurisdiction for a VPN is elevated risk.
• csp_absent manifest No content_security_policy declared (MV3 strict default applies but no explicit CSP).

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled server; full MITM capability.

Pillar Scores

Bookkeeping