Top Risks

• proxy permission lets developer silently route all browser traffic through zhuknet.online (RU-hosted).
• Privacy policy is Google's generic policy — not scoped to this extension; data collection and 3rd-party sharing admitted with no extension-specific disclosure.
• Install URL hijack opens zhuknet.online on installation — unknown Russian domain used as onboarding hook.
• Free-webmail developer (gmail), no developer name, no verified publisher — identity unverifiable.
• Only 73 installs with a HIGH-tier permission (proxy) is a tail-attack-surface red flag.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to an arbitrary server controlled by the developer.
• install_url_hijack crx onInstalled opens https://zhuknet.online — a Russian-hosted domain with no transparent ownership.
• js_external_host_ru crx Extension contacts zhuknet.online (RU geo). Single-country host geo with no CDN diversity.
• generic_google_privacy_policy store Privacy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not specific to this extension.
• free_webmail_no_dev_name store Developer email kristi.tis@gmail.com, developer_name empty, no verified publisher badge.
• small_install_high_perm api 73 installs with high-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 provides strict default, so no additional penalty applied.
• no_cve_findings crx cve_findings_raw is empty; no bundled vulnerable libraries detected.

Permissions Breakdown

• proxy high Can redirect all browser traffic through an arbitrary server; extreme data-interception risk.

Pillar Scores

Bookkeeping