Top Risks

• proxy permission routes all browser traffic through unvetted servers (app.myxavpn.pro, cloudmask.space in NL/RU)
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing
• install_url_hijack opens cloudmask.space on install; anonymous gmail dev with no developer name
• External JS hosts include Telegram (t.me) and two unknown VPN endpoints with no CSP
• Tiny install base (59) with HIGH-tier proxy permission is a tail-attack-surface red flag

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to any server including attacker-controlled endpoints.
• install_url_hijack store install_url_target=https://cloudmask.space/ opens on install; associated with VPN backend domain.
• generic_google_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_dev_no_name store Developer is oveyila408@gmail.com with no developer_name — anonymous gmail dev.
• external_js_hosts crx JS contacts app.myxavpn.pro, cloudmask.space (RU/NL), t.me — three distinct domains, no CSP.
• no_csp manifest csp_present=false; MV3 has strict default but no explicit policy declared, external hosts contacted.
• small_install_high_perm api 59 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm=true.
• geo_diversity api JS hosts span NL and RU (country_count=2); Russian-hosted VPN backend raises jurisdiction risk.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; high abuse potential for interception.

Pillar Scores

Bookkeeping