Top Risks

• proxy permission allows full traffic interception and rerouting through echosecure.space (RU-hosted, unverified).
• install_url_hijack: onInstall opens echosecure.space — third-party domain with no verified ownership.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous operator.
• Small install count (191) with HIGH-tier permission is a tail-attack-surface anomaly.

Evidence

• install_url_hijack crx onInstalled opens https://echosecure.space/ — 3rd-party RU-hosted domain, not dev's own verified domain.
• proxy_permission manifest proxy declared; all browser traffic can be routed through attacker-controlled server echosecure.space.
• generic_privacy_policy store Policy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email chatlak4512@gmail.com, developer_name empty, no verified publisher badge.
• small_install_high_perm api 191 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• js_external_host_ru crx Only external JS host is echosecure.space, geolocated to RU — single country, unverified operator.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• wayback_fetch_error api Wayback ownership check returned ReadTimeout — historical ownership unverifiable.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; critical capability.

Pillar Scores

Bookkeeping