Top Risks

• proxy permission allows full traffic interception/rerouting through turbotunnel.space and app.myxavpn.pro — unknown operators
• Install-URL hijack opens turbotunnel.space on install; operator identity unverifiable (gmail dev, no business entity)
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing without VPN scope
• Free-webmail developer, no developer name, no verified publisher — no accountability for proxy traffic handling
• 4 geo-diverse JS host countries (CA, NL, RU, US) including Russia; RU-hosted endpoint for a proxy/VPN raises interception risk

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to attacker-controlled endpoints (turbotunnel.space, app.myxavpn.pro)
• install_url_hijack crx onInstalled opens https://turbotunnel.space/ — unverified third-party domain, operator unknown
• free_webmail_no_devname store Developer kristi.tis@gmail.com, no developer name, no verified publisher — Reputation floor applied
• generic_privacy_policy store Privacy policy is Google's account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to VPN
• geo_diversity_risk api JS hosts span 4 countries: CA, NL, RU, US — Russian-hosted endpoint for proxy traffic is elevated risk
• small_install_high_perm store 338 installs with proxy (HIGH) permission — tail attack surface anomaly flagged
• external_hosts_unverified crx JS contacts app.myxavpn.pro, turbotunnel.space, t.me — none verifiably tied to a legitimate VPN business
• no_csp manifest content_security_policy is null — MV3 default applies but no explicit CSP hardening declared

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; critical for a VPN but high-impact if malicious.
• https://cloudflare-dns.com/* medium Host permission for DNS-over-HTTPS resolver; appropriate for VPN but grants outbound data access.
• https://dns.google/* medium Host permission for Google DNS-over-HTTPS; appropriate for VPN use case.

Pillar Scores

Bookkeeping