Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Супер VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through attacker-controlled servers (NL/RU geo-diversity observed)
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing
• install_url_hijack=true: extension opens a 3rd-party URL on install (app.getmyxa.com / t.me)
• Developer is free-webmail with no name, no verified publisher status, rating=1

Evidence

• proxy_permission manifest proxy declared; extension can redirect all browser network traffic to arbitrary servers.
• install_url_hijack store install_url_hijack=true; opens 3rd-party page on install. Targets include app.getmyxa.com and t.me.
• privacy_policy_google_generic store PP URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension. Admits data_collection+3rd_party_sharing.
• js_external_hosts crx External JS hosts: app.getmyxa.com (NL), t.me (RU). Geo-diversity NL+RU for a VPN proxy extension.
• developer_identity store Developer: vale99505@gmail.com, no name, not verified, not featured. Free-webmail numbered alias pattern.
• rating store Rating=1, installs=60. Extremely low user trust signals.
• install_perm_anomaly api small_install_high_perm=true: only 60 installs but holds HIGH-tier proxy permission.
• csp_absent manifest No content_security_policy declared (MV3 default applies but no explicit CSP).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Супер VPN [browser-hijack] + malext.io malicious_extension_sentry; score 4.55 -> 7.05 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full control over browser network traffic routing; critical capability for a VPN but also highest exfil risk.

Pillar Scores

Bookkeeping