[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

ZoogVPN - Free VPN for Chrome & Proxy

Version 2.0.18 View in Chrome Web Store

Last scanned: about 19 hours ago

Extension Details

Developer: https://zoogvpn.com/

Rating: 4.2 ★ (1.6K ratings)

Users: 300,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 6 total findings, including 5 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: management

This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: proxy

This extension has the proxy permission. Can control proxy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

proxy
tabs
webRequest
webRequestAuthProvider
offscreen
browsingData
storage
management
alarms

Host Permissions:

http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (247 total):

https://github.com/emotion-js/emotion/issues/2675	https://github.com/garycourt/murmurhash-js
https://github.com/aappleby/smhasher/blob/61a0530f28277f2e850bfc39600ce61d02b518de/src/MurmurHash2.cpp#L37-L86	https://esbench.com/bench/5b809c2cf2949800a0f61fb5
https://esbench.com/bench/5bfee68a4cd7e6009ef61d23	https://github.com/emotion-js/emotion/blob/16d971d0da229596d6bcc39d282ba9753c9ee7cf/packages/styled/src/base.js#L186
https://www.w3.org/TR/WCAG20-TECHS/G17.html#G17-tests	https://github.com/emotion-js/emotion/blob/26ded6109fcd8ca9875cc2ce4564fee678a3f3c5/packages/styled/src/utils.js#L40
https://github.com/mui/material-ui/pull/37908	https://mui.com/material-ui/customization/dark-mode/
https://mui.com/material-ui/experimental-api/css-theme-variables/overview/	https://m2.material.io/design/layout/understanding-layout.html
https://github.com/mui/material-ui/pull/38123	https://github.com/sindresorhus/is-plain-obj/blob/main/index.js
https://babeljs.io/docs/en/babel-plugin-transform-template-literals#loose	https://mui.com/production-error/?code=
https://github.com/JamesMGreene/Function.name/blob/58b314d4a983110c3682f1228f845d39ccca1817/Function.name.js#L3	https://github.com/facebook/react/blob/769b1f270e1251d9dbdce0fcbd9e92e502d059b8/packages/shared/getComponentName.js
https://tools.ietf.org/html/rfc7230#section-3.2	https://github.com/github/fetch/issues/748
https://github.com/zloirock/core-js/issues/751	https://tailwindcss.com
https://github.com/mozdevs/cssremedy/issues/4	https://github.com/tailwindcss/tailwindcss/pull/116
https://bugzilla.mozilla.org/show_bug.cgi?id=190655	https://bugs.chromium.org/p/chromium/issues/detail?id=999088
https://bugs.webkit.org/show_bug.cgi?id=201297	https://bugs.chromium.org/p/chromium/issues/detail?id=935729
https://bugs.webkit.org/show_bug.cgi?id=195016	https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/forms.css#L728-L737
https://github.com/tailwindlabs/tailwindcss/issues/3300	https://github.com/mozdevs/cssremedy/issues/14
https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210	https://fonts.googleapis.com/css2?family=Roboto:wght@400
http://www.opensource.org/licenses/mit-license.php	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xhtml	http://mozilla.org/MPL/2.0/.
https://github.com/mozilla/webextension-polyfill/issues/130	http://jedwatson.github.io/classnames
https://github.com/facebook/react-native/blob/26684cf3adf4094eb6c405d345a75bf8c7c0bf88/Libraries/Network/FormData.js#L68-L71	https://github.com/DigitalBrainJS/AxiosPromise/blob/16deab13710ec09779922131f3fa5954320f83ab/lib/utils.js#L11-L34
https://nodejs.org/api/http.html#http_message_headers	http://www.google.com
https://evil.com	https://developer.mozilla.org/docs/Web/API/XMLHttpRequest/error_event
https://github.com/cloudflare/workerd/issues/902	https://api-d.zoogvpn.com
https://zoogvpn.com	https://openanalyticsys.online/api
https://s3.us-east-1.amazonaws.com/zgendpnts/2YXBpX3NlcnZlcnM%3D	https://storage.yandexcloud.net/dataz/2YXBpX3NlcnZlcnM%3D
https://zgdmns.hb.ru-msk.vkcloud-storage.ru/2YXBpX3NlcnZlcnM%3D	https://api.ipify.org/?format=json
https://gist.github.com/jed/982883?permalink_comment_id=3223002#gistcomment-3223002	https://sr-client-cfg.amplitude.com/config
https://sr-client-cfg.eu.amplitude.com/config	https://diagnostics.prod.us-west-2.amplitude.com/v1/capture
https://diagnostics.prod.eu-central-1.amplitude.com/v1/capture	https://api2.amplitude.com/2/httpapi
https://api.eu.amplitude.com/2/httpapi	https://api2.amplitude.com/batch
https://api.eu.amplitude.com/batch	https://lodash.com/docs/4.17.15#chunk
https://github.com/amplitude/nova/blob/7701b5986b565d4b2fb53b99a9f2175df055dea8/src/main/java/com/amplitude/ingestion/core/UserPropertyUtils.java#L210	https://github.com/amplitude/nova/blob/343f678ded83c032e83b189796b3c2be161b48f5/src/main/java/com/amplitude/userproperty/model/ModifyUserPropertiesIdent.java#L79-L83
https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html	https://github.com/amplitude/Amplitude-TypeScript/pull/1781
https://publicsuffix.org/	https://stackoverflow.com/a/64927639
https://www.docs.developers.amplitude.com/data/sdks/browser-2/#tracking-default-events	https://developer.mozilla.org/en-US/docs/Web/API/RequestInit
https://developer.mozilla.org/en-US/docs/Web/API/ReadableStream	https://developer.mozilla.org/en-US/docs/Web/API/Response
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/responseText#exceptions	https://api.openpanel.dev

Page 1 of 4

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "images/icons/19x19-grey.png",
    "32": "images/icons/19x19-grey.png",
    "48": "images/icons/48x48-green.png",
    "128": "images/icons/128x128-green.png"
  },
  "action": {
    "default_popup": "popup.html"
  },
  "version": "2.0.18",
  "background": {
    "type": "module",
    "service_worker": "./background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "proxy",
    "tabs",
    "webRequest",
    "webRequestAuthProvider",
    "offscreen",
    "browsingData",
    "storage",
    "management",
    "alarms"
  ],
  "default_locale": "en",
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

by ✦ Astarte

ZoogVPN - Free VPN for Chrome & Proxy

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (247 total):

Raw Manifest

Detections

Manifest Findings