Top Risks

• proxy permission gives full traffic interception capability to an unverified gmail dev with no business identity
• Privacy policy is Google's own policy — scope_extension=false, data_collection=true, third_party_sharing=true; not scoped to this extension at all
• Install URL hijack opens stableproxy.space on install; extension contacts app.myxavpn.pro and stableproxy.space — unverified external proxy servers
• Free webmail developer (gmail), no developer name, no verified publisher — no accountability
• Small-install + HIGH-perm anomaly: only 170 users with proxy permission; tail-attack surface

Evidence

• proxy_permission manifest proxy declared; allows full rerouting of all Chrome network traffic through developer-controlled endpoints.
• install_url_hijack crx onInstalled opens https://stableproxy.space — an unverified third-party domain that also appears as a JS external host.
• external_js_hosts crx JS contacts app.myxavpn.pro, stableproxy.space, t.me — two unknown proxy domains plus Telegram; geo: NL and RU.
• privacy_policy_inadequate store Policy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true). Not extension-scoped.
• free_webmail_dev_no_name store Developer email oveyila408@gmail.com; developer_name empty; no verified publisher; no business identity.
• small_install_high_perm api 170 installs with proxy (HIGH-tier) permission — install_perm_anomaly.small_install_high_perm=true.
• russian_geo_endpoint crx host_geo_diversity includes RU alongside NL; stableproxy.space and myxavpn.pro are unverified Russian-adjacent proxy services.
• no_csp manifest content_security_policy is null/absent on MV3 extension; no additional script-src constraints declared.

Permissions Breakdown

• proxy high Full control over all browser network requests; can reroute any traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping