Top Risks

• proxy permission allows full traffic interception via nimbusshield.space and myxavpn.pro — both unverified third-party servers.
• Install URL hijack opens nimbusshield.space on install; developer identity unknown (no name, free-webmail Gmail).
• Privacy policy is Google's own policy (myaccount.google.com) — not scoped to this extension at all; data_collection and third_party_sharing both true.
• JS external hosts include Russian-geolocated servers (NL+RU); no CSP present on MV3 extension.
• No developer name, no verified publisher, no business domain — accountability is essentially zero.

Evidence

• proxy_permission manifest proxy declared; combined with external hosts app.myxavpn.pro and nimbusshield.space — all traffic can be routed through unknown servers.
• install_url_hijack crx onInstalled opens https://nimbusshield.space/ — third-party domain the developer controls, signaling monetization or tracking.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true. Scores +10 privacy.
• free_webmail_no_devname store developer_email=chatlak4512@gmail.com, developer_name empty, no business website — accountability floor triggered.
• geo_diversity api JS hosts span NL and RU (country_count=2); RU-hosted VPN proxy server is a material risk for traffic exfiltration.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening is present.
• external_hosts crx 3 external JS hosts: app.myxavpn.pro, nimbusshield.space, t.me — Telegram contact alongside proxy infrastructure is unusual.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no trust signals present.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; full MITM capability.

Pillar Scores

Bookkeeping