Top Risks

• proxy permission lets developer silently reroute all browser traffic through echosecure.space, a single unknown RU-hosted server
• Privacy policy is Google's generic account policy — does not mention this extension, its data collection, or proxy traffic handling
• install_url_hijack: onInstall opens echosecure.space (unknown third-party), indicating monetization or tracking callback
• Free Gmail dev with no developer name and only 22 installs holding HIGH-capability proxy permission — classic tail-attack surface
• VPN category gets justified-broad-permission discount, but proxy with no host_permissions and external echosecure.space JS host is still high risk

Evidence

• proxy_permission manifest proxy declared; can redirect all Chrome traffic to echosecure.space with no disclosed privacy controls.
• install_url_hijack store onInstalled opens https://echosecure.space/ — unknown RU-hosted domain, potential tracking/monetization callback.
• generic_privacy_policy api Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy.
• free_webmail_no_dev_name store Developer chatlak4512@gmail.com with empty developer_name; no verified publisher; reputation floor triggered.
• small_install_high_perm api install_perm_anomaly: 22 installs + HIGH proxy permission — tail attack surface confirmed.
• js_external_host_ru crx js_external_hosts: [echosecure.space] hosted in RU; only 1 country, but unknown operator with proxy capability is high risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared alongside proxy use.
• cve_findings_empty crx No CVEs detected; cve_findings_raw empty.

Permissions Breakdown

• proxy high Can reroute all browser traffic through attacker-controlled servers; critical capability for a tiny unknown extension.

Pillar Scores

Bookkeeping