Top Risks

• proxy permission grants full control over all browser traffic with unknown stealthpath.space backend
• Privacy policy is Google's own account policy — not scoped to this extension at all (admits data collection + 3rd-party sharing)
• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous operator
• install_url_hijack redirects to stealthpath.space on install; 4 JS external hosts across RU/NL/CA/US
• Only 3 installs with HIGH-tier permission and no accountability signals — classic tail-attack-surface

Evidence

• proxy_permission manifest proxy declared; can redirect all browser traffic through arbitrary server including stealthpath.space
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — unknown domain, no business identity established
• generic_google_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true)
• anonymous_developer store developer_name empty, free-webmail gmail address, no verified publisher badge
• geo_diversity crx JS hosts span 4 countries: CA, NL, RU, US — including RU-hosted endpoint
• small_install_high_perm api Only 3 installs with proxy (HIGH) permission — tail-attack-surface anomaly flagged
• external_hosts crx 5 external JS hosts: app.myxavpn.pro, cloudflare-dns.com, dns.google, stealthpath.space, t.me
• no_csp manifest content_security_policy is null; MV3 provides default but no explicit extension CSP defined

Permissions Breakdown

• proxy high Full proxy control lets the extension reroute all browser traffic through arbitrary servers.
• https://stealthpath.space/* high Unknown throwaway-domain backend; install hijack target; high exfil surface.
• https://cloudflare-dns.com/* low DNS-over-HTTPS to known provider; expected for a VPN/proxy extension.
• https://dns.google/* low DNS-over-HTTPS to Google; expected for a VPN/proxy extension.

Pillar Scores

Bookkeeping