Top Risks

• proxy permission routes all traffic through maskirovka.space/.myxavpn.pro — unknown Russian/Dutch infra, full MITM capability
• install_url_hijack opens maskirovka.space on install — unsolicited third-party page, monetization/track signal
• Privacy policy is Google's own policy (not scoped to this extension) — data handling completely undisclosed
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• 3 installs + high-tier proxy permission = classic tail-attack-surface / low-visibility threat

Evidence

• proxy_permission manifest proxy declared — can silently redirect all browser HTTP(S) through attacker-controlled servers.
• install_url_hijack crx onInstalled opens https://maskirovka.space — unsolicited third-party domain with RU-geo JS host.
• js_external_hosts crx Extension contacts app.myxavpn.pro (NL), maskirovka.space (RU), t.me — 2-country geo spread.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store Developer email egositburak@gmail.com, developer_name empty, no verified publisher badge.
• install_perm_anomaly api 3 installs + has_high_tier_permission=true + small_install_high_perm=true flagged by anomaly detector.
• host_geo_diversity crx JS hosts span NL and RU — two distinct countries for a 3-user VPN extension.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit hardening declared.

Permissions Breakdown

• proxy high Can redirect all browser network traffic through attacker-controlled servers; critical exfil capability.

Pillar Scores

Bookkeeping