Top Risks

• proxy permission routes ALL browser traffic through maskirovka.space (RU-hosted), enabling full MITM on user traffic
• install_url_hijack redirects to maskirovka.space on install — classic phishing/tracking beachhead
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection + 3rd-party sharing
• Free-webmail Gmail dev, no developer name, no verified publisher — unaccountable operator
• JS contacts app.myxavpn.pro + maskirovka.space (NL+RU geo spread) with no CSP — unconstrained external reach

Evidence

• proxy_permission_high_risk manifest proxy declared; routes all browser traffic externally; VPN category but unverified dev.
• install_url_hijack crx onInstalled opens https://maskirovka.space — 3rd-party domain, RU-themed name, tracking/phishing risk.
• external_js_hosts crx js_external_hosts: app.myxavpn.pro, maskirovka.space, t.me — 3 distinct domains, NL+RU geo.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store developer_email=egositburak@gmail.com, developer_name empty, not verified, not featured.
• no_csp manifest content_security_policy is null; MV3 but no explicit CSP set, unconstrained script execution.
• tiny_install_high_perm store Only 4 installs with HIGH-tier proxy permission; install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span NL and RU — two countries; maskirovka.space is Russian-language domain.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; highest-impact VPN/proxy permission.

Pillar Scores

Bookkeeping