Top Risks

• proxy permission routes all browser traffic through vpnfasters.space/app.myxavpn.pro — unknown Russian-hosted infrastructure enabling full MITM
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (D rule: +10.0)
• Install URL hijack opens vpnfasters.space on install; external JS hosts include t.me, app.myxavpn.pro, vpnfasters.space across NL+RU geos
• Developer is anonymous gmail account with no name, no verified publisher status, and a throwaway email pattern
• Only 4 installs with a HIGH-tier permission (proxy) — tail attack surface, low visibility, high capability

Evidence

• proxy_permission manifest proxy declared — entire browser network traffic can be redirected to attacker-controlled servers.
• install_url_hijack crx onInstalled opens https://vpnfasters.space/ — 3rd-party domain not under developer's verified control.
• external_js_hosts crx JS contacts app.myxavpn.pro (RU), vpnfasters.space (NL/RU), t.me — 3 distinct domains, 2-country geo spread.
• generic_google_privacy_policy store Privacy URL is Google account policy (479k chars), scope_extension=false, data_collection=true, third_party_sharing=true — rule D triggers +10.
• anonymous_developer store developer_name is empty, free gmail account kameqoko032@gmail.com, no verified publisher, no featured badge.
• install_perm_anomaly api 4 installs with high-tier proxy permission — small_install_high_perm=true; tail attack surface.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external network contacts.
• geo_diversity crx JS hosts span NL and RU (country_count=2); VPN category partially mitigates but proxy destination remains opaque.

Permissions Breakdown

• proxy high Redirects all browser traffic through attacker-controlled proxy; critical capability for MITM attacks.

Pillar Scores

Bookkeeping