Top Risks

• proxy permission routes all browser traffic through developer-controlled servers (horizonguard.space, app.myxavpn.pro)
• install_url_hijack redirects to horizonguard.space on install — unsolicited 3rd-party navigation
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, 3rd-party sharing=true) — scores 10.0
• Free-webmail developer (gmail), no developer name, no business website — high-anonymity actor
• JS hosts span NL and RU jurisdictions; VPN proxy traffic could be intercepted at either endpoint

Evidence

• proxy_permission manifest proxy declared — can redirect all browser network traffic to horizonguard.space / app.myxavpn.pro
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — unsolicited 3rd-party page load on every install
• generic_privacy_policy store PP URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all
• free_webmail_anonymous_dev store Developer email sedatkilli87@gmail.com, developer_name empty, no business domain
• external_js_hosts crx JS contacts app.myxavpn.pro, horizonguard.space, t.me — 3 distinct registrable domains
• geo_diversity api JS hosts across NL and RU — traffic routing through Russian infrastructure raises interception risk
• small_install_high_perm store Only 9 installs with HIGH-tier proxy permission — tail-attack-surface anomaly flagged
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on JS hosts

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping