Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — кот Vpn [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission grants full browser traffic redirection to unknown servers including app.myxavpn.pro and turbotunnel.space
• Install URL hijack opens turbotunnel.space on install — classic traffic monetization / phishing landing pattern
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing without extension-specific disclosure
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability

Evidence

• install_url_hijack crx onInstalled opens https://turbotunnel.space/ — 3rd-party URL hijack on install (+2.0 webstore)
• proxy_permission manifest proxy declared — HIGH capability; routes all browser traffic; core risk for a 27-install unknown VPN
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D)
• free_webmail_no_dev_name store dev email binoyihe32@gmail.com, developer_name empty, no verified publisher — reputation floor 7.5
• geo_diversity api JS hosts in 4 countries (CA, NL, RU, US); RU jurisdiction notable for proxy/VPN exfil risk (+1.5 network)
• js_external_hosts crx Contacts app.myxavpn.pro, turbotunnel.space, t.me beyond declared host_permissions — unverified VPN backends
• small_install_high_perm api 27 installs + proxy permission — install_perm_anomaly.small_install_high_perm=true (+1.5 webstore)
• no_csp manifest csp_present=false on MV3; MV3 has strict default so no MV2+no-CSP penalty applies, but noted
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — кот Vpn [browser-hijack] + malext.io malicious_extension_sentry; score 5.68 -> 8.18 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-chosen servers.
• host: https://cloudflare-dns.com/* medium DNS-over-HTTPS endpoint access; consistent with VPN function but enables DNS interception.
• host: https://dns.google/* medium DNS-over-HTTPS endpoint access; consistent with VPN function.

Pillar Scores

Bookkeeping