Top Risks

• proxy permission gives complete control over all browser traffic with unknown stealthpath.space backend
• Gmail developer account with no name, no verified publisher — zero accountability
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and third-party sharing
• install_url_hijack: onInstalled opens stealthpath.space — classic monetization/tracking install hook
• Only 13 installs with HIGH-tier proxy permission — tail-attack-surface risk

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect 100% of browser network traffic.
• free_webmail_dev_no_name store Developer is silviaferr79@gmail.com with no developer_name — unverifiable identity.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; data_collection=true, third_party_sharing=true.
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — monetization/tracking install hook.
• small_install_high_perm api 13 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm == true.
• no_csp manifest content_security_policy is null on MV3 extension; MV3 provides some default protection.
• host_geo_diversity api JS hosts span CA, RU, US — 3 countries; stealthpath.space geolocates to RU.
• stealthpath_space_unknown crx stealthpath.space is an unknown domain acting as VPN backend with no public reputation or transparency.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled servers.
• https://stealthpath.space/* high Unknown third-party domain with JS host presence; VPN backend with no transparency.
• https://cloudflare-dns.com/* low Legitimate DNS-over-HTTPS provider; reasonable for VPN DNS resolution.
• https://dns.google/* low Legitimate Google DNS-over-HTTPS; reasonable for VPN DNS resolution.

Pillar Scores

Bookkeeping