Is Proxy Switcher and Manager safe?
We analyzed Proxy Switcher and Manager version 0.6.8's actual code and gave it a 62/100 trust score. This is a purpose-aligned proxy tool, but using…
Bottom line
This is a purpose-aligned proxy tool, but using public proxies can expose browsing traffic to unknown operators.
What it can access
It can reroute all browser traffic, which fits its proxy-switching purpose but gives it powerful network control [Q1][Q18].
Security weaknesses
User-selected remote PAC files can control routing, and chosen proxies can observe unencrypted traffic or HTTPS destination details [Q7][Q14].
Signs of misuse
No evidence shows tracking, credential theft, deceptive changes, or hidden misuse, but the free-proxy option uses unrelated public proxy operators [Q6][Q12][Q17].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests the proxy permission, which can reroute all browser traffic. That power is necessary for the advertised proxy-switching function; site access is optional rather than granted by default.
Declares storage, notifications and proxy plus optional <all_urls> access. — manifest.json:9-16
Builds manual or PAC configurations and applies them through chrome.proxy.settings.set. — data/panel/proxy.js:123-229
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts or scripting permission. — manifest.json:1-42
Requests permission for the user-entered PAC origin immediately before fetching it. — data/panel/components/pac-view.js:216-231
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No website content scripts or page-reading permissions are present. — manifest.json:1-42
Application code configures proxy endpoints but does not inspect request bodies. — data/panel/proxy.js:123-229
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The declared permissions omit cookies, history, bookmarks and downloads. — manifest.json:9-16
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The user can explicitly import a local JSON settings file and can select a local file URL as a PAC source after granting access. No sensors, clipboard or installed-app access was found.
Creates a file picker and imports the selected JSON into extension storage. — data/options/index.js:68-94
Fetches a file:/// PAC only after requesting permission for that exact URL. — data/panel/components/pac-view.js:237-253
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A configured proxy receives browser traffic by design. The built-in search obtains a public proxy list from GitHub, chooses a random SOCKS5 services, and tests requests through it; those proxy operators are unrelated third parties.
Downloads a GitHub-hosted list, randomly selects a SOCKS5 server and constructs a proxy for HTTP, HTTPS and FTP. — data/panel/components/manual-view-search.js:5-42, 73-94
Applies the selected proxy and makes two HEAD requests through it for validation. — data/panel/components/manual-view-search.js:45-56
Applies user-entered proxy hosts and bypass rules to Chrome. — data/panel/proxy.js:123-168, 200-229
Does it download or run code, settings, or instructions supplied by a remote server?
It can install a remote PAC file supplied by the user. PAC content is executable routing logic that decides whether each URL uses a proxy; it is not general extension JavaScript.
Sets either a remote PAC URL or inline PAC source in Chrome's proxy configuration. — data/panel/proxy.js:170-195
Can explicitly fetch a user-entered PAC URL and convert its text to an inline script. — data/panel/components/pac-view.js:216-231
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A saved startup option can reapply a selected proxy mode automatically when Chrome starts. This is user-configured, while normal proxy changes require popup actions.
Reads startup-proxy and applies the stored mode during startup when it is not set to 'no'. — worker.js:108-132
The startup mode is a visible saved option. — data/options/index.js:7-23, 33-49
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It directly changes Chrome's global proxy configuration, which is the central purpose of the product.
Calls chrome.proxy.settings.set for direct, system, auto, manual and PAC modes. — data/panel/proxy.js:200-229
Can restore a user-selected proxy mode at browser startup. — worker.js:108-132
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Loads the packaged Ace editor and JavaScript mode for the PAC editor. — data/panel/components/editor-view/core.js:1-75
Identifies the bundled Ace editor source rather than hidden first-party logic. — data/panel/components/editor-view/ace-builds-1.4.12/src/ace.js:1-20
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No dynamic JavaScript execution helper appears in the service worker. — worker.js:1-187
PAC text is passed to chrome.proxy settings and is not evaluated by extension JavaScript. — data/panel/components/pac-view.js:1-333
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No history or webRequest permission is declared. — manifest.json:9-16
Legacy error-counter code references webRequest but is not loaded by the Manifest V3 worker and lacks the required permission. — badge.js:1-71
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stored values concern appearance, proxy profiles and update timing; no user ID is created. — worker.js:1-187
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension does not extract cookies or page contents, but any selected proxy is in the traffic path. It can see unencrypted HTTP contents and HTTPS destination metadata; encrypted HTTPS bodies are not readable without separate interception trust.
Configures proxy endpoints for HTTP, HTTPS, FTP or fallback traffic. — data/panel/proxy.js:123-168
No cookies or page-content permission is declared; exposure occurs through proxy routing rather than DOM access. — manifest.json:9-16
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content scripts, clipboard or tab-capture capabilities are declared. — manifest.json:1-42
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Network-facing developer interaction is limited to fixed FAQ and uninstall URLs. — worker.js:158-187
Automatic JSON imports originate from chrome.storage.managed, an administrator policy channel. — managed.js:1-55
Remote PAC sources are explicitly entered and applied by the user. — data/panel/components/pac-view.js:216-268
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content script or website injection capability is configured. — manifest.json:1-42
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It intentionally reroutes browser traffic using Chrome's proxy services. The free-proxy option can route traffic through a randomly selected public SOCKS5 server after the user clicks Search.
Constructs and installs manual and PAC proxy configurations. — data/panel/proxy.js:123-229
Selects, activates and tests a third-party public proxy. — data/panel/components/manual-view-search.js:51-56, 73-94
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Temporarily substitutes 127.0.0.1:8888 as a PAC URL during an explicit reload action, then restores the original URL. — data/panel/components/pac-view.js:291-300
No nativeMessaging permission is declared. — manifest.json:9-16
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches PAC text from the entered URL and places it in the inline editor/configuration. — data/panel/components/pac-view.js:216-231
Supplies remote or inline PAC content to Chrome's proxy engine. — data/panel/proxy.js:170-195
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts, externally_connectable or web_accessible_resources section. — manifest.json:1-42
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Background behavior depends on install/startup events, stored user settings and managed policy. — worker.js:108-187
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work updates the icon, restores settings and handles lifecycle events. — worker.js:1-187
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No website content scripts or scripting permission are declared. — manifest.json:1-42