Top Risks

• Install URL hijack opens maskirovka.space on install — likely Russian-language payload/tracking site.
• proxy permission with only 6 installs and gmail dev email: high tail-attack-surface; can intercept all browser traffic.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — admits data sharing without scoping to this extension.
• Free webmail developer (gmail), no developer name, no business website — unverifiable identity.
• JS external hosts include maskirovka.space and app.myxavpn.pro — unknown Russian-language VPN infrastructure, NL+RU geo.

Evidence

• install_url_hijack crx onInstalled opens https://maskirovka.space — Russian-language domain, potential tracking/payload delivery.
• proxy_permission_high_risk manifest proxy declared; can reroute all browser traffic through attacker-controlled infrastructure with only 6 installs.
• free_webmail_no_dev_name store Developer email ekugabezu505@gmail.com with no developer name — unverifiable identity, numbered-alias style.
• privacy_policy_generic_google store Policy URL is Google Account policy: scope_extension=false, admits data_collection+third_party_sharing, not scoped to extension.
• js_external_hosts_suspicious crx Extension contacts app.myxavpn.pro, maskirovka.space, t.me — unknown VPN backend + install-hijack domain + Telegram.
• small_install_high_perm store 6 installs + HIGH-tier proxy permission — tail attack surface flagged by install_perm_anomaly.
• host_geo_diversity api JS hosts in NL and RU — dual-jurisdiction infrastructure raises traffic interception concern.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.

Permissions Breakdown

• proxy high Allows full control over browser network routing; can redirect all traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping