Top Risks

• Brand impersonation: uses 'Adguard VPN' name with no affiliation to AdGuard — likely scam/phishing clone.
• proxy permission with only 7 installs and free-webmail dev: entire browser traffic can be rerouted to vpnfasters.space/myxavpn.pro.
• Install URL hijack to vpnfasters.space — third-party redirect on install is a strong monetization/tracking signal.
• Privacy policy is Google's own account policy, completely unscoped to this extension — no disclosure of data handling.
• Free-webmail dev (imawocigi29@gmail.com), no developer name, no verified publisher — zero accountability.

Evidence

• brand_impersonation_name store Title 'Adguard VPN' mimics registered AdGuard brand; dev is gmail user with no affiliation.
• install_url_hijack crx onInstalled opens https://vpnfasters.space/ — unknown third-party domain, monetization/tracking risk.
• js_external_hosts crx Extension contacts app.myxavpn.pro, vpnfasters.space, t.me — none are AdGuard domains.
• privacy_policy_unscoped store Policy URL is Google's global account privacy page; scope_extension=false, collects+shares data per classification.
• proxy_permission_tiny_install manifest proxy declared, only 7 installs, free-webmail dev — high-capability permission with minimal accountability.
• free_webmail_no_dev_name store imawocigi29@gmail.com numbered alias, empty developer_name — reputation floor triggered.
• small_install_high_perm_anomaly api install_perm_anomaly.small_install_high_perm=true: 7 installs with HIGH-tier proxy permission.
• install_count_minimal store Only 7 installs — essentially unpublished; combined with brand impersonation suggests early-stage attack vector.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled proxy server.

Pillar Scores

Bookkeeping