Top Risks

• proxy permission allows full traffic rerouting through echosecure.space (RU-hosted) with no accountability
• Privacy policy is Google's generic policy — completely unscoped to this extension, admits data collection and 3rd-party sharing
• install_url_hijack opens echosecure.space on install; no developer name, free-webmail dev only
• No developer name, free-webmail (gmail) dev with no verified identity or business presence
• No CSP on MV3; sole JS external host in Russia; no installs data to assess blast radius

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to echosecure.space without user visibility.
• install_url_hijack crx onInstalled opens https://echosecure.space/ — third-party RU-hosted domain, install hijack confirmed.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D3.5 rule applies: +10.0.
• free_webmail_dev_no_name store Developer email aslikap21@gmail.com; developer_name empty; no verified publisher; no business domain.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external JS host.
• external_js_host_ru crx js_external_hosts=[echosecure.space]; host_geo_diversity country_count=1, country=RU.
• no_installs store Install count not available; blast radius unknown but small-install high-perm anomaly applies.
• cve_findings_empty crx cve_findings_raw=[]; no CVE exposure detected.

Permissions Breakdown

• proxy high Can route all browser traffic through attacker-controlled servers; full network interception capability.

Pillar Scores

Bookkeeping