Top Risks

• proxy permission routes ALL browser traffic through developer-controlled servers (app.myxavpn.pro, maskirovka.space)
• install_url_hijack opens maskirovka.space on install — unknown third-party domain with RU geo
• Privacy policy is Google's generic policy — not scoped to this extension; collects+shares data per classification
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• JS external hosts include maskirovka.space (RU) and t.me (Telegram) — anomalous for a VPN extension

Evidence

• proxy_permission manifest proxy declared — full network routing control; VPN category partially justifies but unknown infra is high risk.
• install_url_hijack crx install_url_target=https://maskirovka.space — opens unknown RU-geolocated domain on install.
• js_external_hosts crx Contacts app.myxavpn.pro, maskirovka.space (NL+RU geo), t.me — three unrelated external hosts for a VPN.
• privacy_policy_generic store Policy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Free-webmail gmail dev, empty developer_name, no verified publisher, no business domain.
• install_perm_anomaly api 17 installs + HIGH-tier proxy permission — small_install_high_perm=true; classic tail-attack-surface pattern.
• host_geo_diversity crx JS hosts span NL and RU (country_count=2); RU jurisdiction raises interception risk for a proxy extension.
• csp_absent_mv3 manifest content_security_policy=null; MV3 provides some default protection but no explicit CSP declared.

Permissions Breakdown

• proxy high Allows full control of browser network routing — can redirect all traffic through attacker infrastructure.

Pillar Scores

Bookkeeping