Top Risks

• proxy permission allows complete network traffic interception/redirection for all browser traffic
• Install URL hijack opens ironproxy.space on install — unsolicited 3rd-party page load from unknown domain
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no verified publisher — unaccountable operator
• JS contacts external hosts app.myxavpn.pro, ironproxy.space, t.me — NL+RU geo; ironproxy.space is the install hijack target

Evidence

• proxy_permission manifest proxy declared — VPN category matches function but unverified dev with free-webmail makes this high-risk.
• install_url_hijack crx onInstalled opens https://ironproxy.space/ — same domain as external JS host; unsolicited redirect on install.
• generic_privacy_policy store PP URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_no_devname store chatlak4512@gmail.com, developer_name empty, not verified, not featured → reputation floor ≥7.5.
• external_js_hosts crx JS contacts app.myxavpn.pro, ironproxy.space, t.me — 2 distinct non-telemetry domains, geo NL+RU.
• small_install_high_perm api Only 23 installs with HIGH-tier proxy permission — tail attack surface anomaly confirmed.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no accountability signals.

Permissions Breakdown

• proxy high Full control over all browser network traffic — can redirect, intercept, or block any connection.

Pillar Scores

Bookkeeping