Top Risks

• proxy permission routes all browser traffic through gusentun.space — a domain with no verifiable operator identity.
• Install URL hijack opens gusentun.space on install; extension JS also contacts gusentun.space — unknown third-party infrastructure.
• Privacy policy is Google's own policy (myaccount.google.com); it does not scope to this extension at all — effectively no privacy disclosure.
• Free-webmail dev (asdro1905@gmail.com), no developer name, no business website — unverifiable identity with critical-capability permission.
• 31 installs + proxy permission + throwaway-email dev = tail-attack-surface: low visibility, high potential for targeted interception.

Evidence

• install_url_hijack crx onInstalled opens https://gusentun.space — unknown third-party domain; same domain listed in js_external_hosts.
• proxy_permission manifest proxy declared — can redirect entire browser traffic through attacker-controlled infrastructure.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• developer_identity store Dev email asdro1905@gmail.com (free webmail), no developer name, no business website.
• small_install_high_perm api install_perm_anomaly: 31 installs + HIGH-tier proxy permission → tail-attack-surface flag.
• js_external_hosts crx Extension contacts gusentun.space — unverified Russian-hosted domain (host_geo_diversity: RU only).
• no_csp manifest content_security_policy is null; MV3 mitigates remote eval but no CSP still widens surface.
• reputation_signals store Not verified publisher, not featured, free-webmail only, no recognized org → reputation pillar 8.0.

Permissions Breakdown

• proxy high Proxy can reroute all browser traffic through an attacker-controlled server, enabling MitM on all HTTP/S.

Pillar Scores

Bookkeeping