Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Bye VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission grants full control over all browser network traffic routing; tiny install base + high-capability perm is a tail attack surface.
• Privacy policy is Google's generic policy — does not scope to this extension, admits data collection and third-party sharing (v3.5-D: +10.0).
• Free-webmail developer (kameqoko032@gmail.com) with no developer name or business website — minimal accountability.
• install_url_hijack flag true: extension opens a URL on install, potential for affiliate/ad-tech redirection.

Evidence

• proxy_permission manifest proxy declared — allows complete rerouting of all Chrome network traffic through developer-controlled infrastructure.
• generic_privacy_policy store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — v3.5-D triggers +10.0.
• free_webmail_no_devname store Developer email kameqoko032@gmail.com, no developer_name, no business website — Reputation floor >=7.5 applies.
• install_url_hijack manifest install_url_hijack=true; extension opens external URL on install — potential affiliate/monetization redirect.
• external_js_hosts crx js_external_hosts includes app.getmyxa.com (NL) and t.me (RU); proxy extension contacting these is anomalous.
• small_install_high_perm api 211 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true (+1.5 Webstore).
• host_geo_diversity api JS hosts span NL and RU (count=2); below threshold of 4 for geo-diversity penalty but notable for a proxy extension.
• no_csp manifest content_security_policy is null/absent on MV3; MV3 has strict defaults so no v2 +2.0 penalty applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Bye VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.79 -> 8.29 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full control over browser proxy settings; can route all traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping