Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Vpn ключ [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through stealthpath.space — unknown operator, 8 installs
• Privacy policy is Google's own policy — not scoped to this extension at all; admits data collection and 3rd-party sharing
• Developer is anonymous (no name, gmail account) with no verified identity or business presence
• Install URL hijack opens stealthpath.space on install — onboarding traffic sent to unvetted third-party domain

Evidence

• proxy_permission manifest proxy declared — extension can redirect all network traffic to stealthpath.space or any PAC-controlled destination.
• install_url_hijack store install_url_target=https://stealthpath.space/ — on install browser opens unknown third-party domain.
• generic_privacy_policy store PP URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, email vale99505@gmail.com (free webmail), no verified publisher, no business website.
• tail_attack_surface store 8 installs with high-tier permission (proxy); install_perm_anomaly.small_install_high_perm=true.
• geo_diversity api JS hosts span 3 countries: CA, RU, US — stealthpath.space appears RU-hosted.
• no_csp manifest csp_present=false for MV3 extension; no content_security_policy declared.
• no_developer_domain_info api threat_intel.developer_domain_info=null; stealthpath.space unverifiable throwaway-pattern domain.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Vpn ключ [browser-hijack] + malext.io malicious_extension_sentry; score 5.78 -> 8.28 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control: can intercept and redirect all browser traffic through attacker-controlled servers.
• https://stealthpath.space/* high Unknown throwaway-pattern domain used as install redirect target; full fetch access.
• https://cloudflare-dns.com/* low Public DNS-over-HTTPS resolver; expected for VPN/proxy DNS leak prevention.
• https://dns.google/* low Public DNS-over-HTTPS resolver; expected for VPN/proxy DNS leak prevention.

Pillar Scores

Bookkeeping