Top Risks

• proxy permission routes all browser traffic through neoncloak.space — unknown third-party server operated by unverified Gmail dev.
• install_url_hijack: onInstall opens neoncloak.space, a throwaway-looking domain with RU/NL geo diversity.
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing without scope.
• Free-webmail Gmail developer, no developer name, no verified publisher — no accountability for a traffic-intercepting extension.
• Small install base (281) with HIGH-impact proxy permission is a classic tail-attack-surface pattern.

Evidence

• proxy_permission manifest proxy declared — all browser traffic can be tunnelled through neoncloak.space/app.myxavpn.pro.
• install_url_hijack crx onInstalled opens https://neoncloak.space/ — third-party domain not controlled by any verifiable publisher.
• js_external_hosts crx Extension contacts app.myxavpn.pro, neoncloak.space (RU/NL), and t.me — 3 distinct external domains.
• privacy_policy_generic store Policy URL is Google's own account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email egositburak@gmail.com, developer_name empty, verified_publisher=false.
• small_install_high_perm api install_perm_anomaly: 281 installs with high-tier proxy permission — tail-attack-surface indicator.
• host_geo_diversity crx JS hosts span NL and RU (country_count=2); not disqualifying for VPN but reinforces opacity.
• no_csp manifest content_security_policy is null/absent on MV3 extension; v2 +2.0 Network penalty applied (MV2 rule not triggered but no CSP noted).

Permissions Breakdown

• proxy high Full proxy control routes all browser traffic through attacker-controlled servers — critical for VPN but extremely high-risk.

Pillar Scores

Bookkeeping