Top Risks

• proxy permission allows complete interception and redirection of all browser traffic by unknown developer
• Free-webmail developer (silviaferr79@gmail.com), no verified identity or business website
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Install URL hijack opens cipherway.space on install; extension contacts app.getmyxa.com and t.me externally
• 153 installs with high-tier proxy permission is a tail-attack-surface anomaly

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic through attacker-controlled servers; highest-risk VPN permission.
• free_webmail_dev store Developer email silviaferr79@gmail.com; no developer name; no business website. Reputation floor applies.
• install_url_hijack crx onInstalled opens https://cipherway.space/ — 3rd-party redirect on install is a monetization/tracking signal.
• external_js_hosts crx Extension contacts app.getmyxa.com, cipherway.space, t.me — 3 distinct external domains, two unrelated to VPN.
• privacy_policy_generic store Privacy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true. D clause applies: +10.0.
• small_install_high_perm api install_perm_anomaly: 153 installs with proxy (HIGH). Tail-attack-surface pattern.
• host_geo_diversity api JS hosts span NL and RU (2 countries); RU jurisdiction raises interception risk for a proxy extension.
• no_csp manifest content_security_policy is null (MV3 default CSP applies but no explicit restriction declared).

Permissions Breakdown

• proxy high Full proxy control over all browser traffic; can intercept and redirect any request.

Pillar Scores

Bookkeeping