Top Risks

• proxy permission routes all browser traffic — unknown destination servers (horizonguard.space, app.myxavpn.pro)
• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing
• Install-URL hijack opens horizonguard.space on install — unsolicited navigation to unknown third-party
• Free-webmail developer (gmail), no developer name, no verified publisher — zero accountability
• JS contacts external hosts in NL and RU; Russian-language VPN with opaque operator is high geo-risk

Evidence

• proxy_permission manifest proxy declared — extension can silently redirect all browser traffic to attacker-controlled servers.
• install_url_hijack store onInstalled opens https://horizonguard.space/ — unsolicited third-party navigation on install.
• js_external_hosts crx External JS hosts: app.myxavpn.pro, horizonguard.space, t.me — three distinct registrable domains.
• generic_privacy_policy store Privacy URL is Google account policy (479 KB); scope_extension=false, data_collection=true, third_party_sharing=true — rule D applies (+10).
• free_webmail_no_dev_name store Developer email imawocigi29@gmail.com; no developer name; no verified publisher — Reputation floor >=7.5.
• small_install_high_perm api Only 34 installs with HIGH-tier proxy permission — tail-attack-surface anomaly flagged.
• geo_diversity crx JS hosts span NL and RU — 2 countries; RU geo adds jurisdictional risk for a proxy/VPN product.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP defined.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary servers — core VPN/proxy capability but critical if abused.

Pillar Scores

Bookkeeping