Top Risks

• proxy permission routes all browser traffic; combined with unknown infrastructure (horizonguard.space, myxavpn.pro) is high-risk.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and third-party sharing (v3.5-D → +10.0).
• Free-webmail developer (asdro1905@gmail.com), no developer name, no verified publisher — unaccountable operator.
• install_url_hijack opens horizonguard.space on install; external JS hosts include Russian-NL geo-diverse endpoints.
• Only 146 installs with HIGH-tier proxy permission flags tail-attack-surface anomaly.

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability for a low-install VPN with opaque infrastructure.
• install_url_hijack store install_url_hijack=true targeting horizonguard.space; drives traffic to third-party site on install.
• generic_google_privacy_policy store Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score.
• free_webmail_no_dev_name store Developer email asdro1905@gmail.com, developer_name empty; no verified publisher, no business identity.
• js_external_hosts crx Extension contacts app.myxavpn.pro, horizonguard.space, t.me — 3 distinct domains including Telegram and opaque VPN backend.
• geo_diversity api JS hosts span NL and RU; country_count=2, below threshold of 4 for geo-diversity penalty.
• small_install_high_perm_anomaly store install_perm_anomaly: 146 installs with proxy (HIGH-tier) — tail-attack-surface flag raised.
• no_csp manifest csp_present=false on MV3; v2 calibration: +2.0 network only applies to MV2, no additional penalty here.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through arbitrary proxy servers; critical for VPN but highly abusable.

Pillar Scores

Bookkeeping