Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Fire VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through nimbusshield.space (RU-hosted), a domain with no verifiable legitimacy
• install_url_hijack opens nimbusshield.space on install — onInstalled redirect to unknown 3rd-party domain
• Privacy policy is Google's generic account policy — does not scope to this extension at all; admits data collection and 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no business identity — unverifiable operator

Evidence

• install_url_hijack crx onInstalled opens https://nimbusshield.space/ — unknown 3rd-party domain, +2.0 Webstore
• proxy_permission manifest proxy declared; all browser traffic can be redirected through dev-controlled infrastructure
• js_external_hosts crx app.myxavpn.pro, nimbusshield.space, t.me — 3 distinct external registrable domains; NL+RU geo
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0
• free_webmail_no_devname store oveyila408@gmail.com, no developer name, no business website — floor reputation at 7.5
• small_install_high_perm api 117 installs + proxy permission; install_perm_anomaly.small_install_high_perm=true
• mv3_no_csp manifest csp_present=false; MV3 has strict default so no additional Network penalty applied
• geo_diversity crx JS hosts in NL and RU (count=2); below threshold of 4 for geo-diversity penalty
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Fire VPN [browser-hijack] + malext.io malicious_extension_sentry; score 6.19 -> 8.69 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; full network interception capability.

Pillar Scores

Bookkeeping