Top Risks

• proxy permission routes all browser traffic through attacker-controlled horizonguard.space/app.myxavpn.pro infrastructure
• Free-webmail dev (chatlak4512@gmail.com), no developer name, no verified publisher — anonymous actor
• install_url_hijack: onInstalled opens https://horizonguard.space/ — classic monetization/tracking redirect
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection & 3rd-party sharing
• Only 151 installs with high-impact proxy permission — tail-attack-surface anomaly flagged

Evidence

• install_url_hijack crx onInstalled redirects to https://horizonguard.space/ — unrelated 3rd-party domain, monetization/tracking pattern.
• proxy_permission manifest proxy declared — can intercept and reroute all browser network traffic to developer-controlled servers.
• js_external_hosts crx External JS contacts: app.myxavpn.pro (RU), horizonguard.space (NL), t.me (Telegram) — 3 distinct domains.
• anonymous_developer store developer_name empty, free-webmail gmail dev, no verified publisher, no business website.
• generic_privacy_policy store Privacy policy URL is Google's own account policy — scope_extension=false, data_collection=true, 3rd_party_sharing=true.
• install_perm_anomaly api 151 installs with HIGH-tier proxy permission — small_install_high_perm=true flagged.
• host_geo_diversity api JS hosts span NL and RU — Russian-hosted VPN backend for an anonymous developer is elevated risk.
• no_csp manifest content_security_policy is null (csp_present=false) on MV3 extension — no CSP declared.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through an arbitrary server — complete network interception capability.

Pillar Scores

Bookkeeping