Top Risks

• Proxy permission can silently redirect ALL browser traffic to attacker-controlled server at securepulse.space or app.myxavpn.pro
• Install URL hijack opens securepulse.space on install — classic malware/phishing dropper pattern
• Privacy policy is Google's own generic policy — has no scope to this extension; admits data collection & 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no business identity — unverifiable operator
• External JS hosts include securepulse.space (RU/NL geo) and t.me (Telegram) — opaque command surface

Evidence

• install_url_hijack crx onInstalled opens https://securepulse.space — unknown third-party domain, classic phishing/dropper redirect.
• proxy_permission manifest proxy declared — full traffic interception capability with no legitimate VPN provider identity verified.
• external_hosts crx JS contacts app.myxavpn.pro, securepulse.space, t.me — none correspond to known PrivadoVPN infrastructure.
• privacy_policy_generic store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy) — not scoped to this extension at all.
• free_webmail_no_dev_name store Developer email norkienej@gmail.com; developer_name is empty. No business identity.
• small_install_high_perm api Only 502 installs yet carries HIGH-tier proxy permission — tail-attack-surface anomaly.
• geo_diversity crx JS hosts span NL and RU — Russia-hosted infrastructure for a VPN is a jurisdiction risk.
• brand_impersonation_risk store Name 'PrivadoVPN' mimics legitimate brand privado.com but developer is unverified gmail account.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping