Top Risks

• proxy permission gives full control over all browser traffic routing — core risk for a VPN from unverified gmail dev
• Install URL hijack opens horizonguard.space on install; same domain used as JS external host alongside app.myxavpn.pro
• Privacy policy is Google's own policy (myaccount.google.com) — completely unscoped to this extension; admits data collection + 3rd-party sharing
• Developer is free-webmail gmail with no name, no verified publisher, no business site — anonymous unknown operator
• JS contacts NL+RU hosted endpoints (app.myxavpn.pro, horizonguard.space, t.me) with no CSP; opaque traffic routing

Evidence

• proxy_permission manifest proxy declared — can reroute all browser HTTP/S traffic to any server the extension specifies.
• install_url_hijack store onInstalled opens https://horizonguard.space/ — same domain appears in js_external_hosts.
• free_webmail_no_devname store Developer email chatlak4512@gmail.com; developer_name empty; no verified publisher badge.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0.
• js_external_hosts crx Extension contacts app.myxavpn.pro, horizonguard.space, t.me — NL+RU geo; 3 distinct registrable domains.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.
• small_install_high_perm store Only 43 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span NL and RU (country_count=2); below 4-country geo-diversity threshold.

Permissions Breakdown

• proxy high Full browser proxy control; can redirect all traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping