Top Risks

• proxy permission grants full browser traffic control to an unknown gmail developer with no business identity
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing
• External JS host usachvpn.su (RU) contacted; unknown operator with no verified domain
• Free-webmail developer, no developer name, no verified publisher — extreme accountability gap
• install_perm_anomaly: high-tier permission (proxy) with only 217 installs — small tail, high capability

Evidence

• proxy_permission manifest proxy declared — can reroute all browser traffic through arbitrary SOCKS5 server at usachvpn.su
• free_webmail_developer store Developer email chatlak4512@gmail.com; no developer name; no verified publisher; no business website.
• generic_privacy_policy store Privacy policy URL is Google Account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_host_ru crx js_external_hosts: [usachvpn.su] — Russian domain, single country geo, unknown operator.
• install_url_hijack crx install_url_hijack=true; extension opens a URL on install (target not captured).
• small_install_high_perm api 217 installs with proxy (HIGH) permission — tail-attack-surface anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• no_code_findings crx code_findings_raw empty, obfuscation_score 0.0 — code scan clean but surface is opaque.

Permissions Breakdown

• proxy high Full control of browser network traffic routing; can intercept/redirect all connections.

Pillar Scores

Bookkeeping