Top Risks

• proxy permission allows complete traffic interception/redirection through unverified horizonguard.space infra.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (asdro1905@gmail.com), no developer name, no verifiable business identity.
• Install URL hijack opens horizonguard.space on install — unknown third-party domain with RU/NL hosting.
• JS contacts app.myxavpn.pro and horizonguard.space — unverified endpoints in NL/RU jurisdictions.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic; no host_permissions limit scope.
• install_url_hijack crx onInstalled opens https://horizonguard.space/ — unknown third-party domain.
• js_external_hosts crx Extension contacts app.myxavpn.pro, horizonguard.space, t.me — 3 distinct external domains.
• privacy_policy_generic store Policy URL is Google account policy — not scoped to extension; data_collection+third_party_sharing=true.
• developer_identity store Free-webmail only (gmail), no developer name, no verified publisher, no business website.
• geo_diversity api JS hosts in NL and RU — 2 countries including Russia, elevated for a proxy/VPN tool.
• install_perm_anomaly api small_install_high_perm=true: 635 installs with HIGH-tier proxy permission.
• no_csp manifest content_security_policy is null/absent — no CSP defined for MV3 extension.

Permissions Breakdown

• proxy high Full proxy control — can silently redirect all browser traffic through attacker-controlled server.

Pillar Scores

Bookkeeping