Top Risks

• proxy permission routes ALL browser traffic through horizonguard.space / app.myxavpn.pro — servers in NL and RU with no verified operator identity.
• Install-URL hijack opens horizonguard.space on install — classic monetization/tracking shell pattern.
• Privacy policy is Google's generic account policy — has no scope to this extension; admits data collection and third-party sharing.
• No developer identity (no name, no email, no verified publisher) — zero accountability for a full-traffic proxy.
• External JS hosts include t.me (Telegram) and two unknown domains; no CSP to constrain remote script loading.

Evidence

• proxy_permission manifest proxy declared — all HTTP(S) traffic tunnelled through operator infrastructure (horizonguard.space, app.myxavpn.pro).
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — third-party install redirect, monetization/tracking shell indicator.
• no_csp manifest content_security_policy is null; no CSP to restrict external script loading despite external JS hosts present.
• generic_privacy_policy store Privacy URL points to Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — v3.5 D rule → +10.
• no_developer_identity store developer_name, developer_email, and verified_publisher all missing/false — no accountability for full-traffic proxy.
• geo_diversity crx JS hosts span NL and RU (2 countries); RU-hosted infrastructure for a VPN is elevated risk.
• external_js_hosts crx app.myxavpn.pro, horizonguard.space, t.me contacted — 3 distinct registrable domains, none on allowlist.
• no_store_metadata store title, installs, rating, last_updated all empty — extension not properly listed; maintenance state unknown.

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled servers; core VPN capability but highest-risk single permission.

Pillar Scores

Bookkeeping