Top Risks

• proxy permission lets extension silently reroute all browser traffic through socks-proxy.net or any future server
• 47-month-old extension (last updated July 2022) — abandoned, no security patches
• Privacy policy is Google's generic account policy — zero scope for this extension, admits data collection and 3rd-party sharing
• Free-webmail Gmail dev (vinay.rv@gmail.com), no verified identity or business domain, no accountability
• DOM-XSS sink (innerHTML) in vendor.js with no CSP — exploitable if proxied traffic is attacker-controlled

Evidence

• proxy_permission manifest proxy declared — can redirect all HTTPS/HTTP traffic; paired with socks-proxy.net host dependency.
• stale_extension store Last updated July 2022; 47 months stale. Maintenance pillar = 10.0 (>36mo).
• generic_privacy_policy store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_dev store Developer email vinay.rv@gmail.com; no business domain; Reputation floor >= 7.5 applies.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in js/vendor.js; no CSP present → +2.0 code quality.
• no_csp manifest content_security_policy is null on MV3 extension. Amplifies innerHTML/XSS risk.
• external_hosts crx 4 external JS hosts: reactjs.org, google.com, socks-proxy.net, wikipedia.org. >3 distinct domains → +1.5 network.
• low_rating store Rating 3.7; no review red flags detected by automated scan.

Permissions Breakdown

• storage low Stores extension settings locally; low standalone risk.
• proxy high Full proxy control — can reroute all browser traffic through attacker-controlled server.
• https://www.socks-proxy.net/ high Single host permission to third-party proxy provider; traffic routing dependency.

Pillar Scores

Bookkeeping