Top Risks

• proxy permission grants full traffic interception capability to an unverified gmail developer with no business identity
• Privacy policy is Google's generic account policy — completely unscoped to this extension, admits data collection and 3rd-party sharing
• No developer name, free-webmail email only — zero accountability or identity verification
• Small install count (77) paired with HIGH-tier permission (proxy) — classic tail-attack-surface pattern
• MV3 with no CSP; proxy-capable extension with only 2 JS files scanned provides minimal observable surface area

Evidence

• proxy_permission manifest proxy declared — allows full browser traffic rerouting; no host_permissions or content_scripts limit scope.
• developer_identity store Developer name empty; email is free Gmail (ezagirace763@gmail.com). No business identity, no verified publisher badge.
• privacy_policy_generic store Privacy URL points to Google account policy (479KB). scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0.
• small_install_high_perm api 77 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• free_webmail_dev store ezagirace763@gmail.com with no developer name and no business website raises Reputation floor per free-webmail rule.
• cve_findings_empty crx No CVEs detected; js_libraries_detected empty; code_findings_raw empty.
• wayback_no_history api Wayback check returned fetch_error; no prior ownership snapshot available to verify continuity.

Permissions Breakdown

• proxy high Full proxy control over all browser traffic — can intercept, redirect, or monitor all HTTP(S) connections.

Pillar Scores

Bookkeeping