Top Risks

• proxy permission allows full interception/redirection of all browser traffic to unknown endpoints (app.myxavpn.pro, shieldtunnel.space)
• Install URL hijack redirects to shieldtunnel.space — third-party onboarding with unknown data practices
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no business identity — unaccountable operator
• JS contacts 5 external hosts across 4 countries (CA/NL/RU/US) including Russian-geolocated infra

Evidence

• proxy_permission manifest proxy declared — all browser traffic can be routed through developer-controlled servers.
• install_url_hijack crx onInstalled opens https://shieldtunnel.space/ — third-party domain, unknown ownership.
• external_js_hosts crx 5 external hosts: app.myxavpn.pro, shieldtunnel.space, t.me, cloudflare-dns.com, dns.google.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer: kristi.tis@gmail.com, no developer_name, no verified publisher, free webmail.
• geo_diversity crx JS hosts span 4 countries: CA, NL, RU, US — including Russian-geolocated infrastructure.
• small_install_high_perm api Only 8 installs with HIGH-tier proxy permission — tail-attack-surface anomaly.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit extension CSP declared.

Permissions Breakdown

• proxy high Full proxy control — can intercept/redirect all browser traffic to arbitrary endpoints.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS host access; legitimate for VPN DNS but enables traffic routing.
• https://dns.google/* medium DNS-over-HTTPS host access; same as above.

Pillar Scores

Bookkeeping