Top Risks

• proxy permission allows full routing of all browser traffic through attacker-controlled infrastructure (app.myxavpn.pro, bezopasnet.space)
• Install URL hijack opens third-party domain bezopasnet.space on install — classic monetization/tracking shell pattern
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing
• Free-webmail developer (gmail), no developer name, no verified publisher — zero accountability
• External JS hosts span NL and RU geos with no transparent proxy operator disclosure

Evidence

• proxy_permission manifest proxy declared — can reroute all browser traffic; combined with external host app.myxavpn.pro and bezopasnet.space.
• install_url_hijack store onInstalled opens https://bezopasnet.space/ — monetization/tracking shell fingerprint.
• external_hosts crx JS contacts app.myxavpn.pro, bezopasnet.space, t.me — 3 distinct registrable domains including Telegram.
• generic_privacy_policy store Policy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email imawocigi29@gmail.com, no developer name, not verified publisher, not featured.
• small_install_high_perm api Only 40 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged.
• geo_diversity api JS hosts span NL and RU (2 countries); RU-hosted proxy infrastructure raises geopolitical risk.
• no_csp manifest content_security_policy is null on MV3; no additional script-src protection declared.

Permissions Breakdown

• proxy high Full control over browser network routing; can redirect all traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping