Top Risks

• proxy permission routes ALL browser traffic through stealthpath.space — unknown operator, 8 installs
• Privacy policy is Google's own policy — not scoped to this extension at all; admits data collection and 3rd-party sharing
• Developer is anonymous (no name, gmail account) with no verified identity or business presence
• Install URL hijack opens stealthpath.space on install — onboarding traffic sent to unvetted third-party domain
• JS hosts span CA/RU/US (3 countries) including stealthpath.space hosted in Russia

Evidence

• proxy_permission manifest proxy declared — extension can redirect all network traffic to stealthpath.space or any PAC-controlled destination.
• install_url_hijack store install_url_target=https://stealthpath.space/ — on install browser opens unknown third-party domain.
• generic_privacy_policy store PP URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, email vale99505@gmail.com (free webmail), no verified publisher, no business website.
• tail_attack_surface store 8 installs with high-tier permission (proxy); install_perm_anomaly.small_install_high_perm=true.
• geo_diversity api JS hosts span 3 countries: CA, RU, US — stealthpath.space appears RU-hosted.
• no_csp manifest csp_present=false for MV3 extension; no content_security_policy declared.
• no_developer_domain_info api threat_intel.developer_domain_info=null; stealthpath.space unverifiable throwaway-pattern domain.

Permissions Breakdown

• proxy high Full proxy control: can intercept and redirect all browser traffic through attacker-controlled servers.
• https://stealthpath.space/* high Unknown throwaway-pattern domain used as install redirect target; full fetch access.
• https://cloudflare-dns.com/* low Public DNS-over-HTTPS resolver; expected for VPN/proxy DNS leak prevention.
• https://dns.google/* low Public DNS-over-HTTPS resolver; expected for VPN/proxy DNS leak prevention.

Pillar Scores

Bookkeeping