Top Risks

• proxy permission allows full traffic interception/redirection through turbotunnel.space (unknown third-party)
• Install URL hijack to turbotunnel.space on extension install — monetization/tracking signal
• Privacy policy is Google's own policy (scope_extension=false, admits data_collection+third_party_sharing) — worst-case privacy score
• Free-webmail developer (binoyihe32@gmail.com), no developer name, no verified publisher — no accountability
• Extension contacts 5 distinct external hosts including t.me and app.myxavpn.pro with geo-diversity across 4 countries

Evidence

• proxy_permission manifest proxy declared — can reroute all browser traffic; combined with turbotunnel.space as external host raises interception risk.
• install_url_hijack crx onInstalled opens https://turbotunnel.space/ — third-party install redirect, monetization/tracking pattern.
• generic_google_privacy_policy store Privacy policy URL is myaccount.google.com/privacypolicy — not scoped to this extension; admits data collection and third-party sharing.
• free_webmail_no_dev_name store Developer email binoyihe32@gmail.com, developer_name empty, no verified publisher badge.
• external_hosts crx 5 external hosts: app.myxavpn.pro, cloudflare-dns.com, dns.google, t.me, turbotunnel.space across CA/NL/RU/US.
• geo_diversity api JS hosts span 4 countries (CA, NL, RU, US); geo-diversity +1.5 applies for non-VPN-category justification... but category is VPN, so no penalty.
• install_perm_anomaly api Only 3 installs with high-tier proxy permission — tail attack surface, small_install_high_perm=true.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 default applies, no additional MV2 penalty.

Permissions Breakdown

• proxy high Can redirect all browser traffic through an attacker-controlled proxy server.
• https://cloudflare-dns.com/* medium Needed for DoH DNS resolution; expected for a VPN extension.
• https://dns.google/* medium Needed for DoH DNS resolution; expected for a VPN extension.

Pillar Scores

Bookkeeping