[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

FoxyProxy

Version 9.2 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Developer: Beholder Corporation

Rating: 3.8 ★ (793 ratings)

Users: 500,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: FoxyProxy is a well-established proxy management extension with 500,000 users and a 3.8-star rating, developed by Beholder Corporation. The extension has legitimate use cases for users who need to manage proxy connections for privacy, bypassing geo-restrictions, or corporate network requirements. However, the moderate rating suggests some user concerns.

Concerns: The extension's permission set is extremely powerful and concerning for general users. The combination of proxy control, webRequest interception, broad host permissions, and downloads access creates a perfect storm for potential misuse. The extension can route all your traffic through controlled servers, intercept and modify any web request, download files to your system, and access information from all websites you visit. While these permissions are necessary for proxy functionality, they also enable comprehensive surveillance and data theft if the extension is compromised or malicious.

Recommendations: Only install this extension if you specifically need proxy management functionality and understand the security implications. Run it in a separate Chrome profile dedicated to proxy usage to isolate potential risks from your main browsing. Regularly review the extension's network activity and consider using reputable VPN services instead for general privacy needs. Monitor your download folder for unexpected files and be cautious about which websites you visit while the extension is active.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: proxy

This extension has the proxy permission. Can control proxy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

contextMenus
downloads
notifications
proxy
storage
tabs
webRequest
webRequestAuthProvider

Optional Permissions:

browsingData
privacy

Host Permissions:

<all_urls>

Embedded URLs (176 total):

https://getfoxyproxy.org/geoip/	https://bugzilla.mozilla.org/show_bug.cgi?id=1883896
https://bugzilla.mozilla.org/show_bug.cgi?id=1885509	https://bugzilla.mozilla.org/show_bug.cgi?id=1956860
https://github.com/w3c/webextensions/issues/510	https://bugzilla.mozilla.org/show_bug.cgi?id=1386673
https://bugzilla.mozilla.org/show_bug.cgi?id=1947602	https://github.com/foxyproxy/firefox-extension/issues/220
https://bugs.chromium.org/p/chromium/issues/detail?id=478654	https://bugs.chromium.org/p/chromium/issues/detail?id=1353252
https://foxyproxy-github-io.translate.goog/browser-extension/src/content/help.html	https://buy.stripe.com/00gcNd1YQ2NQbKM148
https://www.paypal.me/ericjung2/5.99	https://getfoxyproxy.org/order/
https://wikipedia.org/wiki/R	https://github.com/w3c/webextensions/issues/429
https://support.google.com/chrome/a/answer/13130396	https://support.mozilla.org/kb/extensions-private-browsing#w_enabling-or-disabling-extensions-in-private-windows
https://github.com/foxyproxy/browser-extension/issues/25	https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#SOCKSv5-proxy-scheme
https://support.mozilla.org/kb/manage-extension-shortcuts-firefox	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/storage/sync
https://github.com/w3c/webextensions/issues/520	https://github.com/w3c/webextensions/issues/351
https://developer.mozilla.org/docs/Web/API/WebRTC_API	https://www.electronjs.org/docs/latest/api/web-contents
https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#bypass-rule_subtract-implicit-rules	https://learn.microsoft.com/en-us/microsoft-cloud/dev/dev-proxy/how-to/intercept-localhost-requests
https://github.com/w3c/webextensions/issues/339	https://bugs.chromium.org/p/chromium/issues/detail?id=1495756
https://developer.chrome.com/docs/extensions/reference/proxy/#bypass-list	https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#Proxy-bypass-rules
https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#Implicit-bypass-rules	https://www-archive.mozilla.org/quality/networking/docs/aboutno_proxy_for
https://support.mozilla.org/kb/connection-settings-firefox	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/proxy/settings
https://bugzilla.mozilla.org/show_bug.cgi?id=1810738	https://searchfox.org/mozilla-central/source/browser/locales/browser/preferences/connection.ftl#64
https://zzz.buzz/2019/12/12/proxy-localhost-and-loopback-in-chrome/	https://issues.chromium.org/issues/40880379
https://bugzilla.mozilla.org/show_bug.cgi?id=1882071	https://bugzilla.mozilla.org/show_bug.cgi?id=1741375
https://bugzilla.mozilla.org/show_bug.cgi?id=1799411	https://bugzilla.mozilla.org/show_bug.cgi?id=1791243
https://bugzilla.mozilla.org/show_bug.cgi?id=1867562	https://bugzilla.mozilla.org/show_bug.cgi?id=1579985
https://bugzilla.mozilla.org/show_bug.cgi?id=1470411	https://bugzilla.mozilla.org/show_bug.cgi?id=1540584
https://developer.mozilla.org/docs/Web/HTTP/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file	https://bugzilla.mozilla.org/show_bug.cgi?id=1725981
https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#http-proxy-scheme	https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#socksv4-proxy-scheme
https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#socksv5-proxy-scheme	https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#quic-proxy-scheme
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_scripts#globs	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/Match_patterns
https://developer.mozilla.org/docs/Web/JavaScript/Guide/Regular_expressions	http://help.example.com/
https://example.com/	https://google.com/ref=examplelist
https://google.com/	https://google.com/ref=help.example.com
https://example.org/	https://help.example.com/
https://exam.com/	http://example.com/
http://example.com/abc	https://help.example.com/abc
https://www.google.com/	https://mail.google.com/
http://1.2.3.4:1080	https://example.com:443
http://user:pass@1.2.3.4?color=663300	https://user:password@78.205.12.1:21?color=ff00bc&title=work%20proxy
https://example.com:443?active=false&title=Work&username=abcd&password=1234&cc=US&city=Miami	http://pac-url.com/etc?type=pac&title=Work
https://github.com/foxyproxy/firefox-extension/wiki/Import-Proxy-List	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/onBeforeRequest#documenturl
https://developer.chrome.com/docs/extensions/reference/webRequest/#event-onBeforeRequest	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/onBeforeRequest#proxyinfo

Page 1 of 3

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "image/icon.png",
    "32": "image/icon32.png",
    "48": "image/icon48.png",
    "128": "image/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "image/icon.png",
      "32": "image/icon32.png"
    },
    "default_popup": "content/popup.html",
    "default_title": "__MSG_extensionName__"
  },
  "author": "Eric Jung",
  "storage": {
    "managed_schema": "content/schema.json"
  },
  "version": "9.2",
  "commands": {
    "disable": {
      "description": "__MSG_disable__"
    },
    "setProxy": {
      "description": "__MSG_setProxy__"
    },
    "excludeHost": {
      "description": "__MSG_excludeHost__"
    },
    "includeHost": {
      "description": "__MSG_includeHost__"
    },
    "setTabProxy": {
      "description": "__MSG_setTabProxy__"
    },
    "unsetTabProxy": {
      "description": "__MSG_unsetTabProxy__"
    },
    "proxyByPatterns": {
      "description": "__MSG_proxyByPatterns__"
    }
  },
  "background": {
    "type": "module",
    "scripts": [
      "content/background.js"
    ],
    "service_worker": "content/background.js"
  },
  "options_ui": {
    "page": "content/options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "contextMenus",
    "downloads",
    "notifications",
    "proxy",
    "storage",
    "tabs",
    "webRequest",
    "webRequestAuthProvider"
  ],
  "homepage_url": "https://getfoxyproxy.org/",
  "default_locale": "en",
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "browsingData",
    "privacy"
  ],
  "minimum_chrome_version": "108",
  "browser_specific_settings": {
    "gecko": {
      "id": "foxyproxy@eric.h.jung",
      "strict_min_version": "128.0"
    },
    "gecko_android": {
      "strict_min_version": "128.0"
    }
  }
}

by ✦ Astarte

FoxyProxy

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (176 total):

Raw Manifest

Detections

Manifest Findings