Top Risks

• proxy permission grants full traffic interception capability with no verified developer identity.
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection & 3rd-party sharing.
• JS contacts unknown/unverified hosts: app.myxavpn.pro and silashield.space alongside Telegram (t.me).
• Developer is free-webmail Gmail, no developer name, no business domain — unverifiable identity behind VPN extension.
• Install-URL hijack flag set (opens 3rd-party URL on install); combined with no CSP and unknown external hosts.

Evidence

• proxy_permission manifest proxy declared — allows full browser traffic redirection to developer-controlled servers.
• install_url_hijack crx install_url_hijack=true; extension opens external URL on install, target not disclosed.
• unknown_external_hosts crx JS contacts app.myxavpn.pro and silashield.space — unverified domains not declared in host_permissions.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email kameqoko032@gmail.com; developer_name empty; no verifiable business identity.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit scoping declared.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — unusual spread for a simple VPN extension.
• small_install_high_perm store Only 40 installs with proxy (HIGH) permission — tail-attack-surface pattern.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; critical capability.
• https://cloudflare-dns.com/* medium Host permission to DNS-over-HTTPS resolver; expected for VPN but widens network reach.
• https://dns.google/* medium Host permission to Google DNS-over-HTTPS; expected for VPN but widens network reach.

Pillar Scores

Bookkeeping