Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Vpn зонт [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through attacker-controlled stealthpath.space infrastructure.
• Privacy policy is Google's generic account policy—does not scope data collection to this extension at all.
• install_url_hijack opens stealthpath.space on install; unknown third-party monetization/tracking destination.
• Free-webmail dev (jomcna56@gmail.com), no developer name, no business website—unverifiable identity.

Evidence

• proxy_permission manifest Single HIGH permission 'proxy' grants full control over browser network routing.
• install_url_hijack store onInstalled opens https://stealthpath.space/ — unknown third-party domain, monetization unknown.
• generic_google_privacy_policy store Privacy URL is Google account policy (479 KB); scope_extension=false, not scoped to this extension.
• free_webmail_no_devname store Developer email jomcna56@gmail.com, no developer name — unverifiable identity per rubric floor ≥7.5.
• external_hosts crx JS contacts stealthpath.space, cloudflare-dns.com, dns.google — 3 distinct domains.
• geo_diversity api Hosting countries: CA, RU, US — RU node present for a VPN proxy service.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP set.
• privacy_policy_data_collection_third_party store Fetched policy: data_collection=true, third_party_sharing=true, scope_extension=false → +10.0 privacy.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Vpn зонт [browser-hijack] + malext.io malicious_extension_sentry; score 4.47 -> 6.97 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full rerouting of browser traffic; highest-impact VPN-class permission.

Pillar Scores

Bookkeeping