Top Risks

• proxy permission routes ALL browser traffic through stealthpath.space — an unknown domain controlled by an anonymous Gmail developer.
• Developer is anonymous (no name, free Gmail, no verified publisher) with only 103 installs — high tail-attack-surface risk.
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and third-party sharing without disclosure.
• Install URL hijack redirects to stealthpath.space on install — classic traffic-monetization/data-capture pattern.
• JS contacts app.myxavpn.pro and t.me in addition to stated hosts — unexplained external endpoints for a VPN extension.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic through developer-controlled stealthpath.space.
• anonymous_developer store developer_name empty, email ezagirace763@gmail.com (free webmail), no verified publisher badge.
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — third-party URL hijack on install.
• generic_privacy_policy store Privacy policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• unexplained_external_hosts crx JS contacts app.myxavpn.pro and t.me — not listed in host_permissions and unrelated to stated VPN function.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — including Russia, unusual for a VPN claiming privacy focus.
• small_install_high_perm store 103 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null/absent; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled endpoints.
• https://stealthpath.space/* high Unknown third-party domain controlled by developer; traffic routed here via proxy.
• https://cloudflare-dns.com/* low Known DNS-over-HTTPS provider; expected for VPN/proxy DNS resolution.
• https://dns.google/* low Known DNS-over-HTTPS provider; expected for VPN/proxy DNS resolution.

Pillar Scores

Bookkeeping