Top Risks

• proxy permission allows full traffic redirection to adversary-controlled server (vpnfasters.space / app.myxavpn.pro)
• Install URL hijack opens vpnfasters.space — throwaway-looking third-party domain on install
• Free-webmail dev (sedatkilli87@gmail.com), no developer name, no verified publisher — anonymous actor
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection & third-party sharing
• Only 4 installs with a HIGH-tier permission (proxy) — tail attack surface, low-visibility supply chain risk

Evidence

• proxy_permission manifest proxy declared; can route all browser traffic through any server, including app.myxavpn.pro and vpnfasters.space.
• install_url_hijack crx onInstalled opens https://vpnfasters.space/ — third-party domain unrelated to any established VPN brand.
• js_external_hosts crx Extension contacts app.myxavpn.pro, t.me, vpnfasters.space — 3 external domains across NL and RU geolocations.
• anonymous_developer store Developer name empty; email is free Gmail (sedatkilli87@gmail.com); no verified publisher badge.
• privacy_policy_generic store Policy URL is Google's account privacy page — not scoped to this extension; admits collection & 3rd-party sharing.
• small_install_high_perm api Only 4 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm == true.
• free_webmail_dev store sedatkilli87@gmail.com is a numbered-alias-style free webmail with no associated business domain.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening declared.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy servers; full network interception capability.

Pillar Scores

Bookkeeping