Top Risks

• proxy permission allows full interception/redirection of all browser traffic by an unverified developer.
• Install URL hijack opens shieldtunnel.space on install — unknown 3rd-party domain.
• Privacy policy is Google's own policy (not scoped to this extension); data handling undisclosed.
• Free-webmail dev (Gmail), no developer name, no verified publisher — anonymous high-capability extension.
• JS contacts app.myxavpn.pro and shieldtunnel.space — unverified external VPN backends.

Evidence

• proxy_permission manifest proxy declared — grants full control over browser network routing to anonymous developer.
• install_url_hijack crx onInstalled opens https://shieldtunnel.space/ — 3rd-party domain not controlled by developer.
• generic_privacy_policy store Privacy policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• anonymous_developer store Free-webmail Gmail dev email, no developer name, not verified publisher, not featured.
• external_js_hosts crx JS contacts app.myxavpn.pro, shieldtunnel.space, t.me — 3+ distinct unverified domains.
• geo_diversity api JS hosts span 4 countries (CA, NL, RU, US); RU-hosted backend for a VPN raises jurisdiction risk.
• small_install_high_perm_anomaly store Only 7 installs with proxy (HIGH) permission — tail-attack surface for targeted deployment.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• proxy high Full control over browser network routing; can intercept/redirect all traffic.
• https://cloudflare-dns.com/* medium Host access to DNS-over-HTTPS endpoint; consistent with VPN function.
• https://dns.google/* medium Host access to Google DNS-over-HTTPS; consistent with VPN function.

Pillar Scores

Bookkeeping