Top Risks

• proxy permission routes all browser traffic through unverified server (app.myxavpn.pro / primeproxy.space, RU-hosted).
• Privacy policy is Google's generic account policy — not scoped to this extension; data handling is undisclosed.
• Install-URL hijack opens primeproxy.space on install — classic monetization/phishing redirect pattern.
• Free-webmail dev (gmail), no developer name, no verified publisher — unaccountable operator.
• JS contacts external hosts in NL and RU (app.myxavpn.pro, primeproxy.space, t.me); high geo-risk for a proxy extension.

Evidence

• proxy_permission manifest proxy declared — full browser traffic redirection capability to app.myxavpn.pro / primeproxy.space.
• install_url_hijack store onInstalled opens https://primeproxy.space/ — third-party URL hijack on install.
• external_js_hosts crx JS contacts app.myxavpn.pro (NL), primeproxy.space (RU), t.me — 3 distinct external domains.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty; free-webmail gmail dev with no business identity.
• small_install_high_perm api Only 13 installs with HIGH-tier proxy permission — tail attack surface anomaly.
• geo_diversity crx JS hosts span NL and RU — 2 countries; RU-hosted proxy backend is elevated risk.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit policy declared).

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; full network interception capability.

Pillar Scores

Bookkeeping