Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — лёгкий Vpn [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through developer-controlled stealthpath.space with no accountability.
• Privacy policy is Google's generic account policy — does NOT scope to this extension or disclose what data is collected.
• Developer: free-webmail (gmail), no name, no verified publisher — zero accountability for a network-routing tool.
• install_url_hijack: onInstalled opens stealthpath.space — monetisation/tracking redirect signal.

Evidence

• proxy_permission manifest proxy declared — full browser traffic routing capability, highest-risk VPN permission.
• install_url_hijack store onInstalled opens https://stealthpath.space/ — third-party redirect on install.
• generic_privacy_policy store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_no_name store Developer email vale99505@gmail.com, developer_name empty, not verified publisher.
• js_external_hosts_include_stealthpath crx stealthpath.space appears in js_external_hosts; unknown domain with CA+RU geo diversity.
• host_geo_diversity_ru api JS hosts span CA, RU, US — Russian-geolocated host in traffic path of a proxy extension.
• small_install_high_perm api 3 installs + proxy permission; install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — лёгкий Vpn [browser-hijack] + malext.io malicious_extension_sentry; score 5.66 -> 8.16 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control routes all browser traffic; can intercept or redirect any request.
• https://stealthpath.space/* high Narrow host permission scoped to developer's own backend; VPN server endpoint.
• https://cloudflare-dns.com/* medium DoH endpoint — DNS over HTTPS; expected for VPN but allows DNS manipulation.
• https://dns.google/* medium Secondary DoH endpoint; same rationale as cloudflare-dns.com.

Pillar Scores

Bookkeeping