Top Risks

• proxy permission routes ALL browser traffic through echosecure.space, a single unverified Russian-hosted server.
• install_url_hijack redirects to echosecure.space on install — unknown third-party operator.
• Privacy policy is Google's own policy (myaccount.google.com), not scoped to this extension at all — admitted data collection/3rd-party sharing without extension scope.
• Developer is anonymous gmail user with no verified publisher status, no business identity, and no developer name.
• Extension contacts external host echosecure.space (RU-hosted) with no CSP declared.

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; no host_permissions narrowing scope.
• install_url_hijack crx install_url_hijack=true targeting https://echosecure.space/ — opens unknown 3rd-party on install.
• js_external_hosts crx echosecure.space is the only external JS host; geo=RU; no CDN or known-safe provider.
• privacy_policy_generic store Policy URL is Google account privacy policy — fetched, scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free webmail (gmail), no verified publisher, no business website.
• no_csp manifest content_security_policy=null; csp_present=false for MV3 extension.
• reputation_free_webmail_no_name store vale99505@gmail.com — free webmail + no developer name triggers floor reputation score.
• cve_findings_empty crx No CVE findings detected; js_libraries_detected empty.

Permissions Breakdown

• proxy high Redirects all browser traffic through attacker-controlled server; highest-capability network permission.

Pillar Scores

Bookkeeping