Top Risks

• Proxy permission routes all browser traffic through horizonguard.space (RU-hosted), enabling interception.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Install URL hijack opens horizonguard.space on install; onboarding traffic redirected to unknown third party.
• Free-webmail dev (gmail) with no developer name and no business website — unverifiable operator identity.
• Only 7 installs with a HIGH-impact permission (proxy) — strong tail-attack-surface / supply-chain risk signal.

Evidence

• proxy_permission manifest proxy declared; can reroute all browser network traffic through attacker-controlled infrastructure.
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — third-party domain, not a recognized dev domain.
• js_external_hosts crx Extension contacts app.myxavpn.pro, horizonguard.space (NL+RU), and t.me — multi-jurisdiction external reach.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email egositburak@gmail.com with empty developer_name — unverifiable operator.
• small_install_high_perm api Only 7 installs with proxy (HIGH) permission — tail-attack-surface anomaly flagged by install_perm_anomaly.
• host_geo_diversity api JS hosts in NL and RU (country_count=2); RU jurisdiction raises interception risk for VPN proxy traffic.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 defaults apply but no explicit CSP declared.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled server; full network interception capability.

Pillar Scores

Bookkeeping