Top Risks

• Brand impersonation of AdGuard VPN by gmail-only dev with no developer name — classic fake VPN pattern.
• proxy permission routes all browser traffic; malicious use would silently MITM user connections.
• install_url_hijack to tunnelbase.space on install — strong indicator of traffic monetization / malware dropper.
• Privacy policy is Google's generic account policy, utterly unscoped to this extension — data handling undisclosed.
• JS external hosts include app.myxavpn.pro and tunnelbase.space, both unknown third parties in NL+RU geo spread.

Evidence

• brand_impersonation store Extension named 'AdGuard VPN' but developer is chatlak4512@gmail.com with no verified publisher status — clear impersonation.
• install_url_hijack manifest onInstalled opens https://tunnelbase.space/ — third-party URL hijack on install, monetization/malware dropper signal.
• free_webmail_no_name store Developer email is chatlak4512@gmail.com; developer_name is empty. Floor reputation at 7.5.
• privacy_policy_generic_google api Privacy policy points to myaccount.google.com — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true. +10.0 privacy.
• js_external_hosts crx Extension contacts app.myxavpn.pro, t.me, tunnelbase.space — 3 distinct external domains, two unknown VPN infra hosts.
• proxy_permission manifest proxy declared — can reroute all browser traffic through arbitrary server; HIGH risk.
• host_geo_diversity api JS hosts span NL and RU (2 countries). RU-hosted VPN infra raises jurisdiction risk.
• no_csp manifest content_security_policy is null; csp_present=false on MV3. No additional network penalty per v2b but noted.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; core VPN capability but extreme abuse potential.

Pillar Scores

Bookkeeping