Top Risks

• proxy permission routes ALL browser traffic through ironproxy.space — unknown Russian-linked infrastructure
• Install URL hijack opens ironproxy.space on install; install_url_hijack=true
• Privacy policy is Google's generic policy — no scope to this extension; data collection and 3rd-party sharing admitted
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• External JS hosts include app.myxavpn.pro and ironproxy.space (RU/NL geo) — unvetted proxy backends

Evidence

• proxy_permission manifest proxy declared — full network interception capability for all browser traffic.
• install_url_hijack crx install_url_target=https://ironproxy.space/ — opens 3rd-party domain on install.
• external_js_hosts crx JS contacts app.myxavpn.pro, ironproxy.space, t.me — unknown proxy backends + Telegram.
• generic_privacy_policy store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer name empty, free-webmail gmail address, no verified publisher, no featured badge.
• host_geo_diversity api JS hosts span NL and RU — 2 countries; RU jurisdiction raises interception risk for VPN.
• small_install_high_perm store Only 33 installs with HIGH-tier proxy permission — tail-attack-surface anomaly.
• no_csp manifest content_security_policy is null; MV3 mitigates some risk but no explicit CSP declared.

Permissions Breakdown

• proxy high Controls all browser network traffic; can route through attacker-controlled servers.

Pillar Scores

Bookkeeping