Top Risks

• proxy permission allows full browser traffic interception and redirection by an unverified free-webmail developer.
• Install URL hijacks user to turbotunnel.space on extension install — install_url_hijack == true.
• Privacy policy is Google's own policy (not scoped to this extension) and explicitly admits data collection and third-party sharing.
• Developer is anonymous (no name, free Gmail, no business domain), high-capability extension with no accountability.
• Geo-diverse JS hosts spanning CA/NL/RU/US including app.myxavpn.pro and t.me — opaque backend infrastructure.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser requests to attacker-controlled server.
• install_url_hijack crx onInstalled opens https://turbotunnel.space/ — 3rd-party install URL hijack confirmed.
• free_webmail_anonymous_dev store Developer email binoyihe32@gmail.com, no developer name, no business domain — unverifiable identity.
• generic_privacy_policy api Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx JS contacts: app.myxavpn.pro, turbotunnel.space, t.me — non-declared opaque endpoints.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — includes Russian-geolocated host.
• small_install_high_perm store Only 489 installs with proxy (HIGH) permission — tail-attack-surface anomaly.
• no_csp manifest content_security_policy is null; MV3 default applies but csp_present==false flagged.

Permissions Breakdown

• proxy high Allows full interception and redirection of all browser network traffic; critical capability.
• https://cloudflare-dns.com/* medium Host permission to Cloudflare DNS; plausible for proxy/DNS-over-HTTPS use.
• https://dns.google/* medium Host permission to Google DNS; plausible for proxy/DNS-over-HTTPS use.

Pillar Scores

Bookkeeping