Top Risks

• proxy permission + gmail dev + no dev name: anonymous actor can reroute all browser traffic with zero accountability
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Install-URL hijack opens routekeeper.space on install — monetization/tracking redirect pattern
• Free-webmail developer email (milumepid39@gmail.com) with no developer name or verified identity
• JS contacts app.myxavpn.pro and t.me in addition to stated hosts — undisclosed external endpoints

Evidence

• proxy_permission manifest proxy declared — extension controls routing of all browser HTTP(S) traffic; HIGH capability.
• free_webmail_dev_no_name store Developer email milumepid39@gmail.com; developer_name empty; no business identity.
• install_url_hijack crx install_url_hijack=true, target=https://routekeeper.space/ — opens 3rd-party URL on install.
• generic_google_privacy_policy store Privacy policy is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; data_collection+third_party_sharing=true.
• undisclosed_js_hosts crx JS contacts app.myxavpn.pro and t.me — not listed in host_permissions; undisclosed external endpoints.
• geo_diversity api JS hosts span CA, NL, RU, US (4 countries); RU-origin infra for a VPN is elevated risk.
• small_install_high_perm_anomaly store 343 installs with proxy permission flagged by install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null / csp_present=false on MV3 extension with proxy capability.

Permissions Breakdown

• proxy high Full proxy control lets extension intercept and redirect ALL browser traffic, highest-risk single permission.
• https://routekeeper.space/* medium Host perm to extension's own backend; required for VPN function but unknown operator trust.
• https://cloudflare-dns.com/* low Legitimate public DNS-over-HTTPS endpoint; consistent with VPN use.
• https://dns.google/* low Legitimate public DNS-over-HTTPS endpoint; consistent with VPN use.

Pillar Scores

Bookkeeping