Is TabProxy — Per-Site Proxy Switcher safe?
We analyzed TabProxy — Per-Site Proxy Switcher version 1.7.0's actual code and gave it a 76/100 trust score. This appears purpose-aligned but powerful: it…
Bottom line
This appears purpose-aligned but powerful: it can route all browser traffic through chosen proxies without evidence of abuse.
What it can access
It can see browser requests across all sites and control proxy routing, while storing optional proxy credentials locally for its core function.[Q1][Q9][Q18]
Security weaknesses
Global proxy changes and automatic credential replies could disrupt or redirect traffic if the extension or its settings are misused.[Q9][Q14][Q18]
Signs of misuse
No evidence shows tracking, covert collection, remote commands, downloaded code, or unrelated traffic manipulation.[Q7][Q12][Q16][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-site request visibility, tab URLs, proxy control, proxy-auth handling, storage, and tab-group access.
Requests proxy, storage, tabs, tabGroups, webRequest, webRequestAuthProvider, and <all_urls>. — manifest.json:22-36
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or scripting permission. — manifest.json:1-45
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Request handling uses URLs, tab IDs, response state, proxy challenges, and configuration rather than response bodies or DOM data. — service_worker.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores proxy services, per-host rules, and optional proxy usernames and passwords in local extension storage.
The configuration schema includes profile host, port, username, and password fields and persists profiles, rules, overrides, modes, groups, and settings with chrome.storage.local. — service_worker.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can import and export configuration files; exports include proxy passwords only after an explicit warning and confirmation.
Reads a user-selected JSON file and creates a local JSON download; the export confirmation states that proxy passwords will be plain text. — options/options.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Configured web traffic is sent through proxy servers chosen by the user; no separate analytics or covert recipient was found.
Generates proxy directives solely from saved user profiles and hostname rules, returning DIRECT for unmatched hosts. — service_worker.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Configuration originates in chrome.storage.local and validated internal UI messages. — service_worker.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once configured, matching requests are routed automatically and proxy credentials may be supplied automatically to matching challenges.
Applies a PAC at startup and configuration changes, tracks main-frame requests, and handles onAuthRequired without another prompt. — service_worker.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It sets Chrome's global regular-profile proxy configuration to a mandatory generated PAC script.
Calls chrome.proxy.settings.set with mode pac_script, packaged generated data, mandatory true, and regular scope. — service_worker.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The bundle contains recognizable configuration schemas, named Chrome APIs, defensive checks, and human-readable status strings. — service_worker.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Extension CSP permits scripts and connections only from self. — manifest.json:32-36
PAC source is generated from validated local configuration and passed to Chrome's native proxy API, not executed as extension-page JavaScript. — service_worker.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses tabs.query/get and main-frame webRequest lifecycle listeners across http and https URLs. — service_worker.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
External network capability is exercised through Chrome proxy routing; no fetch, XHR, beacon, or telemetry client is present. — service_worker.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It handles user-supplied proxy credentials, but releases them only for a proxy challenge matching the active route's host and port.
onAuthRequired requires isProxy, PROXY route type, configured username, equal challenger host, and equal challenger port before returning authCredentials; repeated failures are cancelled. — service_worker.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content script or capture permissions. — manifest.json:1-45
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
runtime messages validate known types and structured payloads, and there is no externally_connectable interface. — service_worker.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content scripts, scripting permission, or page-access UI code is declared. — manifest.json:1-45
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It redirects matching host traffic through configured HTTP, HTTPS, SOCKS4, or SOCKS5 proxies and leaves unmatched hosts direct.
Generated FindProxyForURL checks exact host or subdomain rules, returns the selected profile directive, and defaults to DIRECT; invalid profiles fail closed to 127.0.0.1:9. — service_worker.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:22-36
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
PAC and route state are generated locally from user configuration; no network-fetch API is used. — service_worker.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares neither content scripts nor externally_connectable. — manifest.json:1-45
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Validates known configuration fields, ASCII hostnames, IP syntax, ports, rule domains, profile IDs, message payloads, and active proxy ownership; invalid routes use a closed local endpoint. — service_worker.js:1
Provides visible profile, rule, override, import, export, reset, apply, and confirmation controls. — options/options.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work consists of configuration validation, PAC generation, tab state, and request lifecycle bookkeeping. — service_worker.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
It has no page injection path; form handling is limited to its own options UI. — manifest.json:1-45