Top Risks

• proxy permission routes all browser traffic; combined with external hosts (app.myxavpn.pro, vpnfasters.space) in RU/NL, full MITM risk.
• Privacy policy is Google's own policy — not scoped to this extension; data collection and 3rd-party sharing admitted but unrelated to this product.
• Developer is anonymous (no name, free-webmail Gmail), no verified publisher badge, no business domain.
• Install URL hijack on install opens vpnfasters.space — monetization/tracking redirect on every install.
• Only 17 installs with a HIGH-impact permission (proxy) flags as tail-attack-surface anomaly.

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser network traffic to any server.
• install_url_hijack store install_url_hijack=true, target=https://vpnfasters.space/ — opens 3rd-party URL on every install.
• external_hosts crx JS contacts app.myxavpn.pro, t.me, vpnfasters.space — two distinct registrable domains beyond dev's own.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free-webmail Gmail, no verified publisher badge, no business domain.
• host_geo_diversity api JS hosts span NL and RU (country_count=2); RU jurisdiction raises data-sovereignty concern for a proxy extension.
• small_install_high_perm api Only 17 installs with proxy permission — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy=null, csp_present=false on MV3 extension.

Permissions Breakdown

• proxy high Allows routing all browser traffic through arbitrary proxy servers — highest-impact single permission.

Pillar Scores

Bookkeeping