Top Risks

• proxy permission can route ALL browser traffic through cipherway.space — an unknown third-party server.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack opens cipherway.space on install — classic monetization/redirect shell pattern.
• Free-webmail developer (gmail), no developer name, no business website — unverifiable identity.
• Low install count (150) + HIGH permission (proxy) = tail-attack-surface risk with little community vetting.

Evidence

• proxy_permission manifest proxy declared — routes all traffic; combined with external host cipherway.space this is critical.
• install_url_hijack store onInstalled opens https://cipherway.space/ — monetization/redirect shell signal.
• privacy_policy_generic store PP URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_no_devname store Developer email norkienej@gmail.com, developer_name empty — unverifiable identity, floor reputation ≥7.5.
• js_external_hosts crx Extension contacts app.getmyxa.com, cipherway.space, t.me — 3 distinct external domains including Telegram.
• small_install_high_perm api install_perm_anomaly: 150 installs + proxy permission — minimal community vetting, high tail risk.
• low_rating store Rating 2.3 — below acceptable threshold, suggesting user complaints.
• geo_diversity_RU_NL crx JS hosts span NL and RU — Russian-origin infrastructure warrants additional scrutiny for proxy traffic.

Permissions Breakdown

• proxy high Can redirect ALL browser traffic through an attacker-controlled server; critical capability for a VPN extension.

Pillar Scores

Bookkeeping