Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ёж VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic rerouting through attacker-controlled servers (nimbusshield.space, app.myxavpn.pro)
• Install-URL hijack opens nimbusshield.space on install — monetization or phishing landing page
• Privacy policy is Google's own policy — completely unscoped to this extension, admits data collection and 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability

Evidence

• proxy_permission manifest proxy declared; routes all browser traffic through extension-controlled endpoints including nimbusshield.space and app.myxavpn.pro
• install_url_hijack crx onInstalled opens https://nimbusshield.space/ — third-party domain, monetization/phishing risk
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → scored +10
• free_webmail_no_dev_name store developer_email=kristi.tis@gmail.com, developer_name empty, no verified publisher, no business website
• js_external_hosts crx Extension contacts app.myxavpn.pro, nimbusshield.space, t.me — 3 distinct domains including RU-region hosts
• host_geo_diversity api JS hosts span NL and RU; RU-based proxy backend for a VPN with no transparency is elevated risk
• install_perm_anomaly api Only 20 installs with HIGH-tier proxy permission — small_install_high_perm=true, tail attack surface
• csp_absent_mv3 manifest content_security_policy is null; MV3 default applies but no explicit CSP declared
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ёж VPN [browser-hijack] + malext.io malicious_extension_sentry; score 4.64 -> 7.14 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control lets extension route all browser traffic through arbitrary servers, enabling MITM.

Pillar Scores

Bookkeeping