Top Risks

• proxy permission routes ALL browser traffic through developer-controlled infrastructure (app.myxavpn.pro, silashield.space).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer is anonymous (no name, free-webmail gmail, no verified publisher) with unknown accountability.
• install_url_hijack detected — extension opens a 3rd-party URL on install.
• External JS hosts include silashield.space (unknown .space TLD) and t.me (Telegram), unusual for a VPN.

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser traffic.
• install_url_hijack store install_url_hijack=true; extension opens 3rd-party URL on install.
• generic_privacy_policy crx PP is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true); scores max privacy risk.
• anonymous_developer store developer_name empty, free-webmail gmail, no verified publisher badge.
• suspicious_external_hosts crx JS contacts app.myxavpn.pro, silashield.space, t.me — 3+ distinct domains beyond declared host_permissions.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — includes RU-geolocated host for a VPN.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• no_ratings_no_installs store install_count empty, rating=0; no trust signals from user base.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; critical capability for a VPN.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS host access; consistent with VPN/DNS function but widens network surface.
• https://dns.google/* medium DNS-over-HTTPS host access; legitimate but adds outbound reach.

Pillar Scores

Bookkeeping