Top Risks

• Free-webmail dev (gmail), no developer name, no verified publisher — unaccountable actor with proxy permission.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and third-party sharing.
• Install URL hijack opens shieldtunnel.space; js_external_hosts include app.myxavpn.pro and t.me — opaque backend infra.
• Proxy permission gives complete control over all browser network traffic with only 4 installs — tail attack surface.
• Geo-diversity: JS hosts span CA/NL/RU/US with RU-origin infrastructure raising supply-chain concern.

Evidence

• free_webmail_dev_no_name store Developer email oveyila408@gmail.com; developer_name empty; no verified publisher badge.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing true.
• install_url_hijack crx install_url_hijack=true; target=https://shieldtunnel.space/ — third-party domain opened on install.
• external_hosts_suspicious crx js_external_hosts: app.myxavpn.pro, shieldtunnel.space, t.me — proxy backend and Telegram contact unknown.
• proxy_permission_high_risk manifest proxy declared — full browser network routing control; VPN category provides partial justification.
• geo_diversity_ru_infra api JS hosts span 4 countries: CA, NL, RU, US. RU-hosted infra for a VPN extension is elevated risk.
• install_perm_anomaly api 4 installs + HIGH-tier proxy permission = small_install_high_perm anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.

Permissions Breakdown

• proxy high Allows full control of browser network routing; can intercept all traffic.
• https://cloudflare-dns.com/* medium Host permission to DNS-over-HTTPS endpoint; plausible for VPN use.
• https://dns.google/* medium Host permission to Google DoH endpoint; plausible for VPN use.

Pillar Scores

Bookkeeping