Top Risks

• proxy permission routes ALL browser traffic through ironproxy.space — full interception capability for an unverifiable dev.
• Privacy policy is Google's own generic policy (myaccount.google.com) — not scoped to this extension; admits data collection & 3rd-party sharing.
• install_url_hijack: onInstalled opens ironproxy.space — classic traffic-acquisition / malware install pattern.
• Free-webmail dev (gmail) with blank developer_name and no verified publisher — no accountability.
• JS contacts app.myxavpn.pro, ironproxy.space, t.me — 3 external hosts including Telegram; NL+RU geo distribution.

Evidence

• proxy_permission manifest proxy declared — entire browser network traffic can be intercepted or rerouted by extension.
• install_url_hijack crx onInstalled opens https://ironproxy.space/ — 3rd-party URL hijack on install.
• generic_privacy_policy store Policy URL is Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email kristi.tis@gmail.com, developer_name empty, not verified publisher, not featured.
• external_hosts crx JS contacts app.myxavpn.pro, ironproxy.space, t.me across NL and RU geolocations.
• small_install_high_perm api Only 72 installs with HIGH-tier proxy permission — tail-attack-surface anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 mitigates some risk but no explicit CSP declared.
• cve_findings crx No CVEs detected in bundled libraries.

Permissions Breakdown

• proxy high Routes all browser traffic through an attacker-controlled proxy server; full traffic interception capability.

Pillar Scores

Bookkeeping