Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Tiger Vpn [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through maskirovka.space/.myxavpn.pro — unknown Russian/Dutch infrastructure
• Install URL hijack opens maskirovka.space on install; Gmail developer with no name = unverifiable actor
• Privacy policy is Google's own generic policy, not scoped to this extension; data handling completely undisclosed
• Free-webmail developer (numbered alias aofnoyaofnoy99@gmail.com), no business identity, no verified publisher

Evidence

• proxy_permission manifest proxy declared; all browser traffic can be intercepted and redirected to maskirovka.space / app.myxavpn.pro.
• install_url_hijack crx onInstalled opens https://maskirovka.space — unknown .space domain, RU-geolocated.
• external_js_hosts crx JS contacts app.myxavpn.pro (NL), maskirovka.space (RU), t.me — geo diversity across RU/NL flagged.
• free_webmail_numbered_alias store Developer email aofnoyaofnoy99@gmail.com — numbered alias, no business domain, no developer name.
• privacy_policy_generic_google store Privacy policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• small_install_high_perm api 8 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null on MV3 extension; csp_present=false.
• no_developer_name store developer_name is empty; no verified publisher badge; no featured badge.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Tiger Vpn [browser-hijack] + malext.io malicious_extension_sentry; score 4.43 -> 6.93 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled servers; critical for a VPN but devastating if malicious.

Pillar Scores

Bookkeeping