Top Risks

• proxy permission routes all browser traffic through developer-controlled server pauktun.space
• Privacy policy is Google's own policy — completely unscoped to this extension; data practices unknown
• Install URL hijack opens pauktun.space on install — unknown third-party domain in RU
• Free-webmail developer (gmail), no developer name, no business website; unverifiable identity
• Very low install count (7) combined with HIGH-tier proxy permission is a tail-attack-surface signal

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability; all browser traffic can be redirected.
• install_url_hijack manifest install_url_target=https://pauktun.space/ — opens unknown RU-hosted domain on install.
• js_external_hosts crx pauktun.space is the only external JS host; same domain as install hijack target.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email egositburak@gmail.com; developer_name empty; no business website resolvable.
• small_install_high_perm api Only 7 installs with proxy (HIGH) permission — tail-attack-surface anomaly flagged.
• host_geo api Single JS host in RU (Russia); proxy extension routing through RU infrastructure.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit policy declared.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; critical capability.

Pillar Scores

Bookkeeping