Top Risks

• proxy permission routes all browser traffic; anonymous gmail dev with no verified identity cannot be trusted with this capability
• Privacy policy is Google's own generic policy — does not scope data practices to this extension at all (D clause: +10.0)
• install_url_hijack: extension opens third-party URL on install (app.getmyxa.com / t.me) — monetization/tracking risk
• Free-webmail developer (ekugabezu505@gmail.com), no developer name, no business website — floor reputation ≥7.5
• Small install base (868) with high-impact proxy permission — tail-attack-surface anomaly flagged

Evidence

• proxy_permission manifest proxy declared; routes all browser traffic; HIGH-impact capability per rubric.
• free_webmail_developer store Dev email ekugabezu505@gmail.com, no developer name, no business domain — reputation floor ≥7.5.
• privacy_policy_generic_google store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• install_url_hijack crx install_url_hijack=true; extension contacts app.getmyxa.com and t.me on install — monetization/tracking pattern.
• external_hosts_nl_ru crx js_external_hosts: app.getmyxa.com (NL), t.me (RU); geo-diversity country_count=2, below +1.5 threshold.
• install_perm_anomaly api 868 installs + proxy (HIGH-tier) → small_install_high_perm=true; +1.5 webstore.
• no_csp manifest content_security_policy=null; MV3 strict default applies, no v2 +2.0 penalty applied.
• cve_findings_empty crx No CVEs detected; cve_pillar_score=0.0.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary servers; highest-impact single permission for a VPN extension.

Pillar Scores

Bookkeeping