Top Risks

• install_url_hijack redirects to maskirovka.space on install — strong malware/phishing vector signal.
• proxy permission lets extension intercept and redirect ALL browser traffic.
• Privacy policy is Google's own policy (generic, unscoped) — policy ADMITS data collection & 3rd-party sharing not tied to this extension.
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability.
• JS contacts maskirovka.space (RU-hosted) and app.myxavpn.pro — unknown third-party infra with Russian geo presence.

Evidence

• install_url_hijack manifest onInstalled opens https://maskirovka.space — suspicious Russian-language domain, strong malware-shell indicator.
• proxy_permission manifest proxy declared; routes all browser network traffic through extension-controlled logic.
• js_external_hosts crx Extension contacts app.myxavpn.pro, maskirovka.space (RU/NL), t.me — unverified third-party infra.
• generic_privacy_policy store Privacy URL is Google account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email ekugabezu505@gmail.com; developer_name empty; no verified publisher badge.
• small_install_high_perm api Only 3 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged.
• host_geo_diversity api JS hosts span NL and RU — Russia-hosted endpoint for a VPN with no accountability is elevated risk.
• csp_absent manifest content_security_policy is null — no script execution guardrails despite external host contact.

Permissions Breakdown

• proxy high Proxy permission routes all browser traffic; full interception capability for a VPN shell with 3 installs.

Pillar Scores

Bookkeeping