Top Risks

• proxy permission allows full traffic interception via unverifiable backend (app.myxavpn.pro, shieldtunnel.space) with no accountability.
• Developer is anonymous (no name, free gmail, no business domain); install_url_hijack opens shieldtunnel.space on install.
• Privacy policy is Google's own policy — completely unscoped to this extension; collects and shares data per its own admission.
• Geo-diversity: JS hosts span CA/NL/RU/US (4 countries); Russian-language extension with RU-hosted infra is elevated risk.
• Only 34 installs with HIGH permission (proxy) — classic tail-attack-surface: low-visibility, high-capability.

Evidence

• install_url_hijack crx onInstalled opens https://shieldtunnel.space/ — third-party domain not controlled by verified publisher.
• free_webmail_dev_no_name store Developer email oveyila408@gmail.com; developer_name empty; no business website or verified identity.
• generic_google_privacy_policy store Privacy policy URL is Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• proxy_permission_high_risk manifest proxy declared; full browser traffic routing possible through app.myxavpn.pro and shieldtunnel.space backends.
• geo_diversity_4_countries_ru api JS external hosts span CA, NL, RU, US; Russian-language extension with RU infra; geo_count >= 4.
• external_hosts_unverifiable crx js_external_hosts includes app.myxavpn.pro, shieldtunnel.space, t.me — no relation to declared host_permissions.
• small_install_high_perm api install_perm_anomaly: 34 installs with proxy (HIGH tier) — tail-attack-surface confirmed.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit CSP declared.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; complete network interception capability.
• https://cloudflare-dns.com/* low DNS-over-HTTPS endpoint; expected for VPN/proxy category.
• https://dns.google/* low DNS-over-HTTPS endpoint; expected for VPN/proxy category.

Pillar Scores

Bookkeeping