Top Risks

• proxy permission allows full browser traffic interception via stealthpath.space — unknown, unverified backend.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection + 3rd-party sharing) — worst-case privacy score.
• Free-webmail dev (silviaferr79@gmail.com), no developer name, no verified publisher — zero accountability.
• install_url_hijack opens stealthpath.space on install — unsolicited redirect to unknown third-party.
• Tiny install base (3) with high-impact permission (proxy) — classic tail-attack-surface pattern.

Evidence

• proxy_permission manifest proxy declared — can silently redirect all HTTP/S traffic through stealthpath.space.
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — unsolicited third-party redirect.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store silviaferr79@gmail.com, developer_name empty, no verified publisher badge.
• tiny_install_high_perm api 3 installs + proxy permission — install_perm_anomaly.small_install_high_perm=true.
• unknown_backend_domain manifest stealthpath.space serves as VPN backend; no WHOIS/threat intel available; geo includes RU.
• host_geo_diversity api JS hosts span CA, RU, US — 3 countries; RU hosting for a proxy is elevated risk.
• no_csp manifest csp_present=false; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• proxy high Can route all browser traffic through attacker-controlled servers, enabling full MITM.
• https://stealthpath.space/* high Unknown third-party domain used as VPN backend; install URL hijack redirects here.
• https://cloudflare-dns.com/* low Known public DNS resolver; expected for a VPN/proxy extension.
• https://dns.google/* low Known public DNS resolver; expected for a VPN/proxy extension.

Pillar Scores

Bookkeeping