Top Risks

• proxy permission routes all browser traffic through ironproxy.space/app.myxavpn.pro — unknown operators can intercept everything
• Privacy policy is Google's generic account policy, not scoped to this extension; data collection and 3rd-party sharing admitted without extension-specific disclosure
• Free-webmail dev (oveyila408@gmail.com), no dev name, no verified publisher — zero accountability
• Install URL hijack opens ironproxy.space on install; extension contacts ironproxy.space, app.myxavpn.pro, t.me externally
• Only 9 installs with HIGH-tier permission (proxy) — high tail-attack-surface risk, virtually no community scrutiny

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to ironproxy.space or app.myxavpn.pro, both unverified third-party hosts.
• install_url_hijack crx install_url_target=https://ironproxy.space/ — opens third-party site on install, classic monetization/data-capture pattern.
• js_external_hosts crx Extension contacts app.myxavpn.pro (NL), ironproxy.space (RU), t.me — multi-jurisdiction, includes Russian-hosted proxy endpoint.
• generic_privacy_policy store Privacy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — triggers +10.0 Privacy pillar per v3.5 rule D.
• free_webmail_no_dev_name store developer_email=oveyila408@gmail.com, developer_name empty, no verified publisher — reputation floor applies.
• small_install_high_perm api 9 installs + proxy permission; install_perm_anomaly.small_install_high_perm=true.
• geo_diversity crx JS hosts span NL and RU (2 countries); below +1.5 threshold but Russian-hosted proxy warrants note.
• no_csp manifest content_security_policy=null on MV3 extension; no additional penalty under MV3 rules but no mitigating CSP present.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; critical for a VPN but maximally dangerous if malicious.

Pillar Scores

Bookkeeping