Top Risks

• proxy + webRequest + *://*/* allows complete traffic interception and rerouting for 100K users
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing
• Developer uses free Gmail address with no verifiable business identity or domain
• install_url_hijack flag set: onInstalled opens an external URL, indicating possible redirect monetization
• External JS hosts (semnanweb.com, webtoolkit.info) are low-reputation third-party origins loaded without CSP

Evidence

• proxy+webRequest+broad_host manifest proxy, webRequest, webRequestAuthProvider all declared with *://*/* host permission — full traffic control.
• install_url_hijack crx install_url_hijack==true; target is null but onInstalled redirect to 3rd-party is a monetization/tracking pattern.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• free_webmail_developer store Developer email zhouzhenster@gmail.com; no verified publisher badge; no business domain.
• external_js_hosts crx js_external_hosts: www.gnu.org, www.semnanweb.com, www.webtoolkit.info — 3 external origins, no CSP.
• no_csp manifest content_security_policy is null; MV3 default applies but external host loading is uncontrolled.
• rating_below_threshold store Rating 3.7 — below 4.0; no review red flags matched but moderate dissatisfaction signal.
• install_count_reach store 100,000 installs with high-capability permissions; large blast radius if compromised.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy servers; full traffic interception capability.
• webRequest high Intercepts and can observe all HTTP/S requests across all URLs.
• webRequestAuthProvider high Can supply credentials for proxy auth challenges; credential exposure risk.
• *://*/* high Broad host access covering all URLs amplifies proxy+webRequest risk surface.
• tabs medium Access to tab URLs, titles, and navigation; moderate privacy exposure.
• storage low Local data persistence; low standalone risk.
• offscreen low Background document processing; low risk without evidence of misuse.

Pillar Scores

Bookkeeping