Top Risks

• proxy permission with external hosts in RU/NL allows full traffic interception through attacker-controlled infrastructure
• install_url_hijack: onInstalled opens horizonguard.space — a third-party domain with no disclosed affiliation
• Free-webmail dev (imawocigi29@gmail.com), no developer name, impersonates CyberGhost brand
• Privacy policy is Google's own policy — completely unscoped to this extension; admits data collection and 3rd-party sharing
• JS contacts app.myxavpn.pro and horizonguard.space — unrecognized endpoints; t.me (Telegram) also contacted

Evidence

• brand_impersonation store Extension named 'CyberGhost' — known commercial VPN brand — but developer is anonymous Gmail account with no verified affiliation.
• install_url_hijack crx onInstalled redirects to horizonguard.space — a third-party domain unrelated to CyberGhost or any disclosed developer.
• proxy_permission manifest proxy declared — allows rerouting all browser network traffic through arbitrary servers controlled by the extension.
• external_hosts crx JS contacts app.myxavpn.pro (RU), horizonguard.space (NL/RU), t.me — none disclosed, geo-diverse across 2 countries.
• privacy_policy_generic store Privacy policy points to Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D clause applies: +10.0.
• free_webmail_no_devname store Developer email imawocigi29@gmail.com with no developer name. Numbered-alias pattern in Gmail address.
• install_perm_anomaly api 3 installs + HIGH-tier permission (proxy). small_install_high_perm=true — tail attack surface.
• no_csp manifest content_security_policy is null — MV3 default applies but no explicit CSP declared; combined with external JS hosts.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers — full traffic interception capability.

Pillar Scores

Bookkeeping