Top Risks

• proxy permission gives full traffic redirection capability to unknown gmail-only developer
• Privacy policy is Google's own generic policy — not scoped to this extension at all (admits data collection + 3rd-party sharing)
• Install-URL hijack opens turbotunnel.space on install — install-time redirect to unrelated 3rd-party domain
• Free-webmail developer (chatlak4512@gmail.com), no developer name, no business website — unverifiable identity
• JS contacts 4 countries (CA, NL, RU, US) including Russia; app.myxavpn.pro is an external VPN backend with no disclosed affiliation

Evidence

• proxy_permission manifest proxy declared — redirects all browser TCP connections through developer-controlled servers.
• install_url_hijack crx onInstalled opens https://turbotunnel.space/ — 3rd-party redirect on install.
• free_webmail_no_dev_name store Developer email chatlak4512@gmail.com; developer_name empty; no business domain verifiable.
• generic_google_privacy_policy store Privacy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• external_vpn_backend crx JS contacts app.myxavpn.pro — undisclosed external VPN backend; not listed in host_permissions.
• geo_diversity_russia api JS hosts span CA, NL, RU, US — includes Russian-hosted infrastructure for a VPN extension.
• small_install_high_perm store Only 219 installs with HIGH-tier proxy permission — tail-attack-surface anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.

Permissions Breakdown

• https://dns.google/* medium Google DNS-over-HTTPS endpoint; same rationale as cloudflare-dns.
• proxy high Full proxy control lets extension intercept/redirect all browser traffic — core VPN risk surface.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS endpoint; consistent with VPN function but still a sensitive network target.

Pillar Scores

Bookkeeping