Top Risks

• proxy permission routes ALL browser traffic through stealthpath.space — unverifiable operator with free-webmail identity.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack fires on install opening stealthpath.space — unsolicited third-party navigation.
• No developer name, free-webmail (gmail) dev email, no verified publisher — zero accountability.
• Small-install + HIGH-permission anomaly (5 installs, proxy) — classic tail-attack-surface pattern.

Evidence

• proxy_permission manifest proxy declared — full browser traffic redirection capability to stealthpath.space.
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — unsolicited third-party redirect.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name_free_webmail store developer_name empty; email ezagirace763@gmail.com — no verifiable business identity.
• small_install_high_perm api Only 5 installs with proxy permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_russia api js_external_hosts include stealthpath.space hosted in RU (Russia) — elevated jurisdiction risk.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no trust signals from Google.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled servers.
• https://stealthpath.space/* high Unknown third-party domain; extension routes traffic and contacts this host on install.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS endpoint; legitimate for VPN but grants network-level visibility.
• https://dns.google/* medium DNS-over-HTTPS endpoint; legitimate for VPN but grants network-level visibility.

Pillar Scores

Bookkeeping