Top Risks

• proxy permission allows full rerouting of browser traffic to echosecure.space (RU-hosted).
• Privacy policy is Google's generic policy — not scoped to this extension; data_collection and third_party_sharing admitted.
• Install URL hijack opens echosecure.space on install — unknown third-party domain.
• Free-webmail developer (gmail), no developer name, no verified publisher — zero accountability.
• Only 3 installs with HIGH-tier permission (proxy) — classic tail-attack-surface fingerprint.

Evidence

• proxy_permission manifest proxy declared; can silently reroute all HTTPS/HTTP traffic through echosecure.space.
• install_url_hijack crx onInstalled opens https://echosecure.space/ — unknown RU-hosted domain.
• generic_privacy_policy store PP is Google account policy (myaccount.google.com), not scoped to this extension; scope_extension=false.
• free_webmail_no_devname store Developer email vale99505@gmail.com, no developer name, not verified, not featured.
• small_install_high_perm api Only 3 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm=true.
• js_external_host_ru crx echosecure.space (RU geo) is the sole external JS host; proxy traffic presumably routed there.
• no_csp manifest content_security_policy is null; csp_present=false for MV3 extension.
• pp_admits_data_collection_third_party store PP classification: data_collection=true, third_party_sharing=true, scope_extension=false → Privacy pillar max.

Permissions Breakdown

• proxy high Full proxy control; can reroute all browser traffic through attacker-controlled infrastructure.

Pillar Scores

Bookkeeping