Is ClearWeb safe?
ClearWeb is medium risk. Opening the ClearWeb popup sends stored account and client identifiers to MacPaw's analytics endpoint. The data comes from extension storage and is transmitted to api-lytics.macpaw.com/actions as part of the popup-open event.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup open sends account and client IDs to MacPaw analytics.
Opening the ClearWeb popup sends stored account and client identifiers to MacPaw's analytics endpoint.
The data comes from extension storage and is transmitted to api-lytics.macpaw.com/actions as part of the popup-open event.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user opens the ClearWeb extension popup.
The extension sends a popup open analytics event that includes the user's account identifier and persistent client UUID.
- Stored account and client identifiersaccount_id and client UUID stored by the extension (illustrative)
Links the popup open event to the user's ClearWeb account and a persistent browser-side client UUID.
Popup fetches remote feature flags with a production client key.
Opening the ClearWeb popup initializes an Unleash feature-flag client against unleash-edge.clearvpn.com, using a hardcoded production client key.
It sends storage context so the service can return feature toggles affecting popup behavior.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
The user opens the ClearWeb extension popup.
The popup fetches feature flags from an Unleash Edge server using a hardcoded production client key.
- Extension storage data{"environment":"production"} (illustrative)
Storage-derived context can influence which feature flags the remote service returns for the extension.
ClearWeb fetches ClearVPN profile and VPN credentials on install
Installing ClearWeb requests your ClearVPN profile from MacPaw's API.
The confirmed response includes account details, subscription information, and VPN user credentials, which the extension caches in local storage.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user installs ClearWeb.
The extension requests the ClearVPN profile and stores the returned profile locally.
- VPN credentialsvpn-user-123 / password-value (illustrative)
The profile response includes VPN login and password fields tied to the account.
- Stored profile dataaccount_id, email, subscription, vpn_user_credentials (illustrative)
The extension caches returned account and subscription profile data in browser extension storage.
Observed during dynamic analysis: the profile endpoint returned account, subscription, and VPN credential fields, and the extension cached the profile in local extension storage.
+2 more findings not shown