Top Risks

• proxy permission routes ALL browser traffic through bezopasnet.space — unknown Russian operator can intercept everything
• Privacy policy is Google's own policy, completely unscoped to this extension; admits data collection and 3rd-party sharing
• Free-webmail developer (imawocigi29@gmail.com), no developer name, no verifiable identity
• install_url_hijack opens bezopasnet.space on install; 7 installs + high-perm is a tail-attack-surface signal
• JS external hosts include bezopasnet.space (RU) and app.myxavpn.pro (NL) with no accountability or privacy disclosure

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability, routed through bezopasnet.space/app.myxavpn.pro
• install_url_hijack crx onInstalled opens https://bezopasnet.space/ — third-party domain, monetization/tracking signal
• generic_privacy_policy store Privacy policy is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_no_dev_name store Developer email imawocigi29@gmail.com, developer_name empty, no verified publisher, no featured badge
• js_external_hosts crx app.myxavpn.pro (NL), bezopasnet.space (RU), t.me — 3 distinct domains across 2 geo-diverse countries
• tiny_install_high_perm store 7 installs + proxy permission: small_install_high_perm=true; tail-attack-surface pattern
• no_csp manifest csp_present=false on MV3; v2 calibration +2.0 network applied (MV2 rule not applicable but no CSP noted)
• geo_diversity crx JS hosts span NL and RU (country_count=2); below +1.5 threshold of 4 but RU jurisdiction risk noted

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled proxy; complete network interception capability.

Pillar Scores

Bookkeeping