Top Risks

• proxy permission lets extension silently route ALL browser traffic through unknown servers (app.myxavpn.pro, silashield.space)
• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous actor with critical capability
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — unscoped and misleading
• install_url_hijack=true: extension opens 3rd-party URL on install — onboarding traffic monetization or phishing risk
• JS external hosts include silashield.space and t.me alongside VPN infra — suspicious non-VPN endpoints

Evidence

• proxy_permission_high_risk manifest proxy declared — can intercept and redirect all browser network traffic to attacker-controlled hosts.
• anonymous_free_webmail_dev store dev email kameqoko032@gmail.com (numbered alias), developer_name empty, no verified publisher, no business domain.
• brand_impersonation_proton store Title uses 'Proton' brand but confirmed_owner=false and not a Proton-affiliated publisher.
• install_url_hijack crx install_url_hijack=true: extension opens 3rd-party URL on install.
• suspicious_js_external_hosts crx JS contacts app.myxavpn.pro, silashield.space, t.me — unrelated to declared DNS hosts; silashield.space is opaque.
• generic_google_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• geo_diversity_4_countries api JS hosts span CA, NL, RU, US — 4 countries including RU; unusual for a minimal VPN extension.
• small_install_high_perm_anomaly store Only 11 installs with proxy (HIGH) permission — tail attack surface / test-phase malware pattern.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; critical capability for a VPN impostor.
• host: https://cloudflare-dns.com/* medium DNS-over-HTTPS access; legitimate for VPN/proxy but grants network observation capability.
• host: https://dns.google/* medium DNS-over-HTTPS access; same reasoning as above.

Pillar Scores

Bookkeeping