Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — муха Vpn — лёгкий доступ [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through bezopasnet.space — unknown Russian operator can intercept everything
• Privacy policy is Google's own policy, completely unscoped to this extension; admits data collection and 3rd-party sharing
• Free-webmail developer (imawocigi29@gmail.com), no developer name, no verifiable identity
• install_url_hijack opens bezopasnet.space on install; 7 installs + high-perm is a tail-attack-surface signal

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability, routed through bezopasnet.space/app.myxavpn.pro
• install_url_hijack crx onInstalled opens https://bezopasnet.space/ — third-party domain, monetization/tracking signal
• generic_privacy_policy store Privacy policy is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_no_dev_name store Developer email imawocigi29@gmail.com, developer_name empty, no verified publisher, no featured badge
• js_external_hosts crx app.myxavpn.pro (NL), bezopasnet.space (RU), t.me — 3 distinct domains across 2 geo-diverse countries
• tiny_install_high_perm store 7 installs + proxy permission: small_install_high_perm=true; tail-attack-surface pattern
• no_csp manifest csp_present=false on MV3; v2 calibration +2.0 network applied (MV2 rule not applicable but no CSP noted)
• geo_diversity crx JS hosts span NL and RU (country_count=2); below +1.5 threshold of 4 but RU jurisdiction risk noted
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — муха Vpn — лёгкий доступ [browser-hijack] + malext.io malicious_extension_sentry; score 4.41 -> 6.91 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled proxy; complete network interception capability.

Pillar Scores

Bookkeeping