Is 1Click Safe Browsing safe?

Medium risk

1Click Safe Browsing sends every page you open, with headers and page title, to its own servers.

For each website or frame you navigate to, the extension collects the URL, page title, window name, referrer, request and response headers, server IP and tab IDs. It compresses this and posts it to safe-browsing.1clickvpn.com, which goes well beyond a simple URL reputation check. A filter masks some URL parameters and credentials, but the host, path and titles are still sent.

developerv1.1.0Chrome Web Store
49Risk
Who publishes it

developer - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
developer

Same store account

1 other listing published from this account, 400k+ users between them. 1 of them carries a finding.

1ClickVPN Proxy for Chrome400k+High

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

1ClickVPN sends full details of every page you load to safe-browsing.1clickvpn.c

Code analysis shows each http(s) page you open is reported to safe-browsing.1clickvpn.com with its URL, title, referrer, headers and server IP, more than a safety check needs.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page.

The listeners cover every http and https main frame and sub frame.

The extension did this

The extension reports the visit, with page details and headers, to a remote server.

A compressed record goes to safe-browsing.1clickvpn.com/api/rest/v2/secure/urls/checkSafety.

Fields in each navigation record
  • Page address
    https://www.example.com/account/orders

    The address of the page you are on, after partial masking of some parameters.

  • Page title
    Your orders - Example Shop

    The title shown in your tab, which often names the content you are viewing.

  • Referrer
    https://www.google.com/

    The page you came from before this one.

  • Request and response headers
    user-agent, accept-language, content-type

    Headers your browser sent and the site returned for the page load.

  • Server IP and tab IDs
    93.184.216.34, tab 412, opener 408

    Where the site is hosted, plus identifiers for the tab and the tab that opened it.

  • Panelist and partner IDs
    panalyticsId, instance 2, partner 18, distributor 18

    A persistent identifier that ties records from the same browser together.

The code that does this

Stream configured in FULL_NAVIGATION mode

Readable version
let Nn = null;const registerSafeBrowsingHelper = async () => {  chrome.tabs.onRemoved.addListener(async e => {    const t = await r.read();    delete t[e], await r.write(t)  });  const e = await getPanelIdentity();  Nn = await Wt._$createStream((e => ({    _$mode: "FULL_NAVIGATION",    _$enabled: !0,    _$apiUrl: Kt("https://safe-browsing.1clickvpn.com"),    _$panalyticsId: e.panalyticsId,    _$pinstanceId: Number("2"),    _$partnerId: Number("18"),    _$distributorId: Number("18"),    _$compressRequest: !0,    _$sensitiveDataCheckEnabled: !0,
The code that does this

Page fields read from the tab and listeners registered

Readable version

Page data

service_worker.js
je._$getPageData = () => ({    name: window.name,    title: document.title,    referrer: document.referrer  });

Listeners

service_worker.js
    const _$phaseInitializationStarted = () => {        F[U._$INITIALIZATION_STARTED] = !0, chrome.webRequest.onSendHeaders.addListener(_$callback((e, t) => {          e._$webRequestHeadersSent(t)        }), j, ["requestHeaders"]), chrome.webRequest.onHeadersReceived.addListener(_$callback((e, t) => {          e._$webRequestHeadersReceived(t)        }), j, ["responseHeaders"]), chrome.webRequest.onResponseStarted.addListener(_$callback((e, t) => {          e._$webRequestResponseStarted(t)        }), j, ["responseHeaders"]), chrome.webNavigation.onBeforeNavigate.addListener(_$callback((e, t) => {          e._$webNavigationBeforeNavigate(t)        })), chrome.webNavigation.onCompleted.addListener(_$callback((e, t) => {          e._$webNavigationComplete(t)        })), chrome.webNavigation.onCreatedNavigationTarget.addListener(_$callback((e, t) => {          e._$createdNavigationTarget(t)        })), chrome.webNavigation.onHistoryStateUpdated.addListener(_$callback((e, t) => {          e._$historyStateUpdated(t)
Where the data goes
    • safe-browsing.1clickvpn.com

    Receives the compressed navigation records via checkSafety.

    • id.1clickvpn.com

    Supplies the persistent ID and the masking rules refreshed every 360 minutes.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed 1Click Safe Browsing contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • id.1clickvpn.com

    1Click Safe Browsing sends data to id.1clickvpn.com. No other extension we have analysed sends data here.

  • safe-browsing.1clickvpn.com

    1Click Safe Browsing sends data to safe-browsing.1clickvpn.com. No other extension we have analysed sends data here.

Updated 15 October 2026imencghpahhiccjnnpfgmdpckiiepmmm