Top Risks

• proxy permission enables full traffic interception; install_url_hijack opens neoncloak.space — a throwaway domain unrelated to any VPN provider.
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing (D-rule: +10.0).
• Free-webmail dev (chatlak4512@gmail.com), no developer name, no verified publisher — identity entirely unverifiable.
• JS contacts app.myxavpn.pro and neoncloak.space: two unknown/non-brand external hosts plus t.me, creating a high-capability covert exfil surface.
• 73 installs + high-permission (proxy) anomaly: tail-attack-surface signal; likely test or targeted deployment.

Evidence

• install_url_hijack crx onInstalled opens https://neoncloak.space/ — a non-VPN-provider throwaway domain, classic redirect abuse.
• external_js_hosts crx JS contacts app.myxavpn.pro, neoncloak.space, t.me — three distinct external domains beyond any known VPN service.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D-rule applies.
• free_webmail_no_dev_name store Developer email chatlak4512@gmail.com; developer_name empty; no verified publisher badge.
• proxy_permission manifest proxy declared — can silently reroute all browser traffic through arbitrary servers.
• small_install_high_perm api Only 73 installs with HIGH-tier proxy permission; install_perm_anomaly.small_install_high_perm=true.
• geo_diversity crx JS hosts span NL and RU — two countries; below +1.5 threshold (count < 4).
• no_csp manifest content_security_policy is null; MV3 has strict default but install-URL hijack and external hosts elevate risk without explicit CSP.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; critical capability for a VPN impostor.

Pillar Scores

Bookkeeping