Top Risks

• proxy permission allows full traffic interception and rerouting through cipherway.space (RU-hosted unknown operator)
• Privacy policy is Google's generic account policy — completely unscoped to this extension; admits data collection and 3rd-party sharing
• Free-webmail dev (silviaferr79@gmail.com), no developer name, no verified publisher — zero accountability
• install_url_hijack: onInstalled opens cipherway.space (3rd-party, Russian-hosted), monetization/tracking risk
• External JS hosts include app.getmyxa.com and t.me — unexpected for a VPN; no CSP to constrain them

Evidence

• proxy_permission manifest proxy declared; VPN category justifies it but cipherway.space server identity is unverified and RU-hosted.
• install_url_hijack crx onInstalled opens https://cipherway.space/ — 3rd-party domain, install URL hijack confirmed.
• generic_privacy_policy store Policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_no_devname store silviaferr79@gmail.com, developer_name empty, not verified, not featured → reputation floor 7.5+.
• external_js_hosts crx app.getmyxa.com, cipherway.space, t.me contacted externally; RU+NL geo; no CSP to restrict loading.
• no_csp manifest content_security_policy is null; MV3 has strict defaults but no explicit CSP declared.
• small_install_high_perm api 22 installs with proxy (HIGH permission) — install_perm_anomaly flagged by scanner.
• host_geo_diversity crx JS hosts span NL and RU (2 countries); RU jurisdiction raises data-sovereignty concern for a VPN.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; critical for a VPN but maximum trust risk.

Pillar Scores

Bookkeeping