Top Risks

• proxy permission lets developer redirect ALL browser traffic through neoncloak.space/myxavpn.pro — both unknown entities
• install_url_hijack opens neoncloak.space on install; privacy policy is Google's own policy, entirely unscoped to this extension
• Developer is anonymous (no name, free webmail gmail), tiny install base with HIGH-tier permission — tail attack surface
• JS contacts app.myxavpn.pro and neoncloak.space (NL+RU geo) — unverified offshore endpoints handling proxy routing
• Privacy policy (Google account policy) admits data collection & 3rd-party sharing — not scoped to this extension at all

Evidence

• proxy_permission manifest proxy declared — can intercept and reroute all browser HTTP/HTTPS traffic to any server.
• install_url_hijack crx onInstalled opens https://neoncloak.space/ — unknown third-party domain, monetization/tracking unknown.
• js_external_hosts crx Extension contacts app.myxavpn.pro, neoncloak.space, t.me — unverified endpoints in NL and RU.
• privacy_policy_unscoped store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D(v3.5 rule D) → +10.
• anonymous_developer store developer_name empty, free webmail (gmail), no verified publisher, no business domain.
• small_install_high_perm api Only 4 installs yet proxy (HIGH-tier) declared — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy null/absent on MV3 — no additional CSP hardening present.
• geo_diversity crx JS hosts span NL and RU (2 countries); below threshold of 4 for geo-diversity bonus.

Permissions Breakdown

• proxy high Full proxy control — can reroute all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping