Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Батя ВПН — надёжное подключение [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/rerouting through unverified servers (app.myxavpn.pro, bezopasnet.space).
• Privacy policy is Google's generic policy — not scoped to this extension; data_collection and third_party_sharing admitted without extension context.
• Free-webmail gmail dev, no developer name, no verified publisher — unaccountable operator.
• Install-time URL hijack opens bezopasnet.space — unknown third-party site on install.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to attacker-controlled endpoints.
• install_url_hijack manifest onInstalled opens https://bezopasnet.space/ — unknown third-party domain.
• js_external_hosts crx Extension contacts app.myxavpn.pro, bezopasnet.space, t.me — 3 distinct registrable domains.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer email kameqoko032@gmail.com (free webmail), no developer name, no verified publisher.
• small_install_high_perm api Only 19 installs but holds proxy (HIGH) permission — install_perm_anomaly flagged.
• host_geo_diversity api JS hosts span NL and RU — 2 countries; RU-hosted proxy infra raises jurisdiction concern.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Батя ВПН — надёжное подключение [browser-hijack] + malext.io malicious_extension_sentry; score 5.55 -> 8.05 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; critical capability for a VPN category.

Pillar Scores

Bookkeeping