Top Risks

• Brand impersonation of Windscribe VPN: free-webmail dev with no verified identity routes all traffic via stealthpath.space.
• proxy permission routes all browser traffic through unknown stealthpath.space backend — zero accountability.
• Privacy policy is Google's own policy (not scoped to this extension); data handling completely undisclosed.
• Developer is free-webmail (gmail), no name, no verified publisher — no accountability trail.
• install_url_hijack opens stealthpath.space on install; monetization/tracking intent likely.

Evidence

• brand_impersonation store Title 'Windscribe VPN - free' mimics real Windscribe brand; dev is silviaferr79@gmail.com with no affiliation.
• proxy_permission manifest proxy declared — all browser traffic routable through stealthpath.space, a third-party unknown domain.
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — redirects user to operator-controlled site immediately.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer name empty; email silviaferr79@gmail.com — free webmail, no business identity.
• small_install_high_perm api 377 installs with HIGH-tier proxy permission — tail attack surface anomaly flagged.
• host_geo_diversity crx JS hosts span CA, RU, US (3 countries); RU-hosted endpoint for a VPN proxy raises interception risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit lockdown declared.

Permissions Breakdown

• proxy high Full proxy control allows routing all browser traffic through attacker-controlled server.
• https://stealthpath.space/* high Unknown third-party domain; proxy backend could intercept and log all traffic.
• https://cloudflare-dns.com/* low Legitimate Cloudflare DNS-over-HTTPS endpoint; low risk on its own.
• https://dns.google/* low Legitimate Google DNS-over-HTTPS endpoint; low risk on its own.

Pillar Scores

Bookkeeping