Top Risks

• proxy permission allows full traffic interception/MITM by dev-controlled infrastructure
• Privacy policy is Google's own generic policy — does not scope to this extension at all (D rule: data_collection+third_party_sharing+scope==false → +10)
• Install URL hijack redirects new users to a Telegram bot (t.me) — suspicious onboarding channel
• Free-webmail dev (gmail) with no developer name and no business website — unverifiable identity
• Small install count (80) with high-tier proxy permission — classic tail-attack-surface pattern

Evidence

• proxy_permission manifest proxy declared — can silently reroute all HTTPS traffic through developer-controlled server.
• install_url_hijack store onInstalled opens https://t.me/myxavpn_bot?start=M5400VB7 — Telegram bot, not a website.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not the extension's.
• free_webmail_no_dev_name store Developer email aslikap21@gmail.com; developer_name is empty; no business presence.
• small_install_high_perm api 80 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm == true.
• external_js_host_telegram crx js_external_hosts contains t.me — Telegram endpoint referenced in extension JS.
• no_csp manifest content_security_policy is null; csp_present == false on MV3 extension.
• cve_pillar_clean crx cve_findings_raw empty; no known vulnerable libraries detected.

Permissions Breakdown

• proxy high Can route all browser traffic through an attacker-controlled server; full MITM capability.

Pillar Scores

Bookkeeping