Top Risks

• proxy permission allows full traffic interception/redirection through attacker-controlled servers
• Install URL hijack opens pauktun.space on install — unknown third-party domain, single JS host
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing
• Free-webmail developer (vale99505@gmail.com), no developer name, no verified identity
• Small install base (70) with high-impact permission is tail-attack-surface indicator

Evidence

• proxy_permission manifest proxy declared — can silently reroute all browser traffic to any server operator controls.
• install_url_hijack crx onInstalled opens https://pauktun.space/ — same domain as sole JS external host.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email vale99505@gmail.com; developer_name empty; no verified publisher badge.
• small_install_high_perm api 70 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• js_external_host crx Single external JS host: pauktun.space (RU-geolocated). No CSP present on MV3 extension.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 — default strict but no explicit hardening.
• no_obfuscation_no_code_findings crx obfuscation_score=0.0, code_findings_raw empty across 2 JS files scanned.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy servers; critical MITM capability.

Pillar Scores

Bookkeeping