Top Risks

• proxy permission routes ALL browser traffic through developer-controlled servers (turbotunnel.space, app.myxavpn.pro).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Install URL hijack: onInstalled opens https://turbotunnel.space/ (third-party).
• Developer is anonymous gmail user with no verified identity, no developer name, very low install base.
• JS contacts 4 countries (CA, NL, RU, US) including Russia; external hosts include t.me and unknown VPN backend.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser network traffic through arbitrary endpoints.
• install_url_hijack crx onInstalled opens https://turbotunnel.space/ — third-party monetization/tracking site.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_anonymous_dev store Developer email binoyihe32@gmail.com with no developer name and 28 installs.
• external_hosts crx JS contacts app.myxavpn.pro, turbotunnel.space, t.me — opaque VPN backend and Telegram.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US. RU jurisdiction raises data-sovereignty risk.
• small_install_high_perm api install_perm_anomaly: 28 installs with HIGH-tier proxy permission — tail attack surface.
• no_csp manifest content_security_policy is null; MV3 default applies but extension has no explicit CSP hardening.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through arbitrary servers; highest-impact proxy control.
• https://cloudflare-dns.com/* medium Host permission to contact Cloudflare DNS; consistent with proxy/DNS function.
• https://dns.google/* medium Host permission to contact Google DNS; consistent with proxy/DNS function.

Pillar Scores

Bookkeeping