Top Risks

• Brand impersonation of Proton VPN: gmail dev with no name, contacts securepulse.space/myxavpn.pro — not Proton AG infrastructure.
• proxy permission routes all browser traffic through attacker-controlled servers (securepulse.space, app.myxavpn.pro).
• Install URL hijack opens securepulse.space on install — classic malware/adware dropper pattern.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability.

Evidence

• brand_impersonation_manual store Title 'Proton VPN' claimed by ekugabezu505@gmail.com; verified Proton AG extension is different; confirmed_owner=false.
• install_url_hijack crx onInstalled opens https://securepulse.space — 3rd-party domain unrelated to Proton AG.
• external_js_hosts crx JS contacts app.myxavpn.pro, securepulse.space, t.me — none are Proton AG infrastructure.
• proxy_permission manifest proxy permission declared; can intercept and redirect all browser network traffic.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email ekugabezu505@gmail.com, developer_name empty, no verified publisher, no featured badge.
• small_install_high_perm api 326 installs with HIGH-tier proxy permission flagged as tail attack surface anomaly.
• host_geo_diversity crx JS hosts span NL and RU — 2 countries including Russia, consistent with rogue proxy infrastructure.

Permissions Breakdown

• proxy high Controls all browser network traffic; can redirect/intercept connections. Highest-capability single permission.

Pillar Scores

Bookkeeping