Top Risks

• proxy permission routes all browser traffic through attacker-controlled gusentun.space (RU-hosted)
• install_url_hijack opens gusentun.space on install — classic traffic-monetization or credential-harvest vector
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• Only 51 installs + HIGH permission (proxy) signals tail-attack-surface / targeted deployment

Evidence

• install_url_hijack crx onInstalled opens https://gusentun.space — single external host, RU-geolocated, also listed in js_external_hosts.
• proxy_permission manifest Declares 'proxy' — grants full control over browser network routing to extension.
• privacy_policy_generic_google store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store developer_email=namikkm13@gmail.com, developer_name empty, no verified publisher, no featured badge.
• small_install_high_perm api Only 51 installs with proxy (HIGH) permission — tail-attack-surface anomaly confirmed by install_perm_anomaly.
• js_external_host_ru crx js_external_hosts=[gusentun.space]; host_geo_diversity countries=[RU]; single foreign jurisdiction.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• no_operator_siblings api sibling_count=0; no broader operator cluster detected, but fingerprint ties email+domain together.

Permissions Breakdown

• proxy high Full proxy control; can intercept/redirect all browser traffic to arbitrary hosts.

Pillar Scores

Bookkeeping