Top Risks

• proxy permission lets extension redirect ALL browser traffic through unverifiable servers (app.myxavpn.pro, bezopasnet.space)
• Gmail developer with no name, no verified publisher — unaccountable for traffic interception at install base
• Privacy policy is Google's own policy (not scoped to this extension); admits data collection and 3rd-party sharing
• Install-URL hijack opens bezopasnet.space on install — unknown third-party domain receives install event signal
• JS contacts 5 external hosts including bezopasnet.space (install hijack target) and t.me (Telegram); geo-diversity across RU/NL/CA/US

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability for a 252-install unknown extension.
• install_url_hijack crx onInstalled opens https://bezopasnet.space/ — unknown domain also appears in js_external_hosts.
• free_webmail_dev_no_name store Developer email imawocigi29@gmail.com; developer_name empty; no verified publisher badge.
• generic_google_privacy_policy store Privacy URL is Google account policy, not extension-scoped; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx JS contacts: app.myxavpn.pro, bezopasnet.space, cloudflare-dns.com, dns.google, t.me — 5 distinct hosts.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — unusually diverse for a simple VPN proxy.
• small_install_high_perm store 252 installs with proxy (HIGH) permission — tail attack surface on low-visibility extension.
• no_csp manifest content_security_policy is null/absent on MV3 extension; v2 calibration +2.0 network for MV2 does not apply but CSP absence noted.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; highest-impact VPN permission.
• https://cloudflare-dns.com/* medium Host permission for DNS-over-HTTPS; expected for VPN but widens network surface.
• https://dns.google/* medium Host permission for Google DoH; expected for VPN but widens network surface.

Pillar Scores

Bookkeeping