Top Risks

• proxy permission from unverified gmail dev: all browser traffic can be tunneled through silashield.space (unknown jurisdiction, no accountability).
• Install hijack opens silashield.space on install — 3rd-party URL with no disclosed ownership.
• Privacy policy is Google's own account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (kameqoko032@gmail.com), no developer name, no verified business; classic throwaway fingerprint.
• Geo-diverse JS hosts across CA, NL, RU, US (4 countries) with small install base raises targeted exfil concern.

Evidence

• install_url_hijack crx onInstalled opens https://silashield.space — unregistered 3rd-party domain, not disclosed in store listing.
• proxy_permission manifest proxy declared; routes all browser traffic through extension-controlled servers with no auditable infrastructure.
• free_webmail_dev_no_name store Developer email kameqoko032@gmail.com; developer_name is empty; no business website or verified publisher badge.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to extension.
• external_js_hosts crx JS contacts: app.getmyxa.com, silashield.space, t.me — none disclosed in description; purpose unknown.
• host_geo_diversity api JS served from 4 countries: CA, NL, RU, US — RU-hosted infrastructure for a VPN is elevated risk.
• small_install_high_perm store 860 installs with HIGH-tier proxy permission flagged by install_perm_anomaly as tail-attack-surface candidate.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP restricts external script loading.

Permissions Breakdown

• proxy high Allows routing all browser traffic through attacker-controlled servers; critical capability for a VPN.
• https://cloudflare-dns.com/* medium Host permission for DNS-over-HTTPS; expected for VPN but still a data channel.
• https://dns.google/* medium Host permission for Google DNS-over-HTTPS; expected for VPN but still a data channel.

Pillar Scores

Bookkeeping