Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Urban Vpn [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/rerouting with no host restrictions
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection + 3rd-party sharing
• install_url_hijack: extension opens a third-party URL on install (install_url_target unknown)
• External JS hosts include app.getmyxa.com and t.me — non-VPN-infrastructure domains with geo in NL/RU

Evidence

• proxy_permission manifest Single HIGH permission 'proxy' declared; enables full browser traffic redirection.
• install_url_hijack crx install_url_hijack=true; extension opens external URL on install — target unknown.
• generic_google_privacy_policy store Privacy policy is Google's own account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts_non_vpn crx js_external_hosts: app.getmyxa.com (NL) and t.me (RU) — neither is a standard VPN infrastructure domain.
• no_developer_identity store developer_name, developer_email all empty; verified_publisher=false; no featured badge.
• maintenance_unknown api months_since_update=null; last_updated missing; scored conservatively at 6-12mo band.
• host_geo_diversity crx JS hosted across NL and RU — 2 countries; moderate geo-diversity flag for a VPN tool.
• no_csp manifest content_security_policy=null; MV3 default CSP applies but no explicit policy declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Urban Vpn [browser-hijack] + malext.io malicious_extension_sentry; score 5.60 -> 8.10 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full traffic rerouting; can intercept/redirect all browser network traffic.

Pillar Scores

Bookkeeping