Top Risks

• proxy+webRequest+<all_urls>: full browser traffic interception and rerouting capability.
• Install & uninstall URL hijacks redirect to short.gy and go.ly monetization links.
• Gmail developer with no business domain; privacy policy is generic Google policy, not extension-scoped.
• 12 external JS hosts contacted including ip-api.com, ipinfo.io, go.ly — broad data exfil surface.
• Privacy policy fetched but admits data collection and third-party sharing without scoping to this extension.

Evidence

• proxy+webRequest+<all_urls> manifest Combination routes all browser traffic through attacker-controlled proxy and can observe every request.
• install_url_hijack crx onInstalled opens https://proxyswitcher.short.gy/fUloTl — third-party monetization redirect.
• uninstall_url_hijack crx setUninstallURL points to https://go.ly/ESgma — uninstall tracked by third-party link shortener.
• gmail_developer_no_domain store Developer email anellenback1@gmail.com; no verified business domain; free-webmail threshold met.
• generic_privacy_policy store Policy is Google's own account privacy page; scope_extension=false, admits data collection+3rd-party sharing.
• 12_external_hosts crx js_external_hosts includes go.ly, ip-api.com, ipinfo.io, proxyswitcher.short.gy among 12 distinct domains.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• no_verified_publisher_badge store verified_publisher=true per store flag but developer is free-webmail gmail with no business domain.

Permissions Breakdown

• storage low Stores proxy settings locally; standard low-risk.
• proxy high Full control over all browser network routing; critical capability.
• webRequest high Can observe all HTTP/S requests across every site visited.
• webRequestAuthProvider high Can intercept and supply proxy authentication credentials.
• <all_urls> high Broad host access amplifies proxy+webRequest to full traffic visibility.

Pillar Scores

Bookkeeping