Top Risks

• proxy permission routes all browser traffic through vpnfasters.space — operator-controlled infrastructure in RU/NL.
• Install-URL hijack opens https://vpnfasters.space/ on install — classic monetization/tracking shell pattern.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — no extension-specific disclosure.
• Free-webmail dev (namikkm13@gmail.com), no developer name, no verified publisher — unaccountable operator.
• Only 5 installs with high-tier proxy permission — tail-attack-surface anomaly.

Evidence

• proxy_permission manifest proxy declared — can silently redirect all browser HTTP/HTTPS through any server chosen by developer.
• install_url_hijack crx onInstalled opens https://vpnfasters.space/ — external monetization/tracking redirect confirmed.
• js_external_hosts crx Extension contacts app.myxavpn.pro (NL), vpnfasters.space (RU), t.me — 2-country geo spread, unknown operators.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D clause applies (+10).
• free_webmail_no_devname store Developer email namikkm13@gmail.com, developer_name empty, not verified — Reputation floor triggered.
• no_csp manifest content_security_policy is null; MV3 provides strict default but no explicit policy declared.
• small_install_high_perm api install_perm_anomaly: 5 installs + proxy permission — tail-attack-surface confirmed.
• geo_diversity crx JS hosts span NL and RU; VPN category partially justifies but unknown operator in RU is elevated risk.

Permissions Breakdown

• proxy high Full proxy control routes all browser traffic through attacker-chosen servers; critical capability for a VPN shell.

Pillar Scores

Bookkeeping