Top Risks

• proxy permission routes all browser traffic through extension-controlled server (app.getmyxa.com, NL/RU geo)
• Privacy policy is Google's generic account policy — completely unscoped to this extension, admits data collection and 3rd-party sharing
• Free-webmail developer (gmail) with no developer name, no verified publisher, no business website
• install_on_install URL hijack detected; only 13 installs with high-tier proxy permission is a tail-attack-surface signal
• External JS hosts include t.me (Telegram) and app.getmyxa.com — two distinct non-dev-domain endpoints for a VPN

Evidence

• proxy_permission manifest proxy declared — can silently reroute all browser traffic to arbitrary server.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email kristi.tis@gmail.com, developer_name empty, no business domain, not verified publisher.
• install_url_hijack crx install_url_hijack=true; extension opens 3rd-party URL on install.
• external_js_hosts crx js_external_hosts: app.getmyxa.com (NL), t.me (RU) — two non-extension-store endpoints.
• small_install_high_perm api Only 13 installs with high-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span NL and RU (2 countries). RU-hosted endpoint for VPN extension warrants scrutiny.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled proxy server; critical capability for a VPN extension.

Pillar Scores

Bookkeeping