Is Freezen MateVPN Chrome safe?
Freezen MateVPN for Chrome is high risk. Every time you open the popup, it reads the active tab URL and sends it in a plain-HTTP GET to api.positionbox.com, a third-party geolocation service, automatically before you interact. The listing calls it a VPN tool, not mentioning it.…
Who publishes itFreeTools - 2 other listings from the same operator, none carrying a finding
FreeTools - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 30k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Active tab URL sent to positionbox.com on every popup open
Every time you open the popup, it reads the active tab URL and sends it in a plain-HTTP GET to api.positionbox.com, a third-party geolocation service, automatically before you interact.
The listing calls it a VPN tool, not mentioning it.
You open the extension popup.
No further interaction is required, the request fires on DOMContentLoaded.
Your active tab's URL is sent to api.positionbox.com via an unencrypted HTTP GET request.
The request includes your IP address and the full URL of the page you are visiting as a query parameter.
| Field | Value | Why it matters | |
|---|---|---|---|
Current page URL | https://mail.google.com/mail/u/0/#inbox | The full address of the tab you have open, reveals the sites you visit, including paths and query strings. | |
Your IP address | 203.0.113.47 | Your public IP address is visible to positionbox.com from the HTTP connection itself. |
URL collection and transmission, popup.js lines 35-59
chrome.tabs.query({'active': true, 'lastFocusedWindow': true}, function (tabs) {
var url = tabs[0].url; // Active tab URL captured here
var xhr = new XMLHttpRequest();
// Tab URL appended as query parameter; plain HTTP — no TLS
xhr.open("GET", "http://api.positionbox.com/?module=Chrome&action=getIPGeoLocation&url=" + url, true);
xhr.onreadystatechange = function() {
if (xhr.readyState == 4) {
var resp = JSON.parse(xhr.responseText);
// Response populates display fields and rewrites button hrefs to ZenMate affiliate URLs
document.getElementById('js_tab_geolocation_your_ip').innerHTML = resp.positionbox.request.ip;
document.getElementById('js_btn_your_ip_show_on_map').setAttribute('href', 'https://zenmate.com/?utm_medium=affiliate&utm_source=5134448...');
document.getElementById('js_tab_website_ip').innerHTML = resp.positionbox.website.ip;
document.getElementById('js_btn_show_on_map').setAttribute('href', 'https://zenmate.com/?utm_medium=affiliate&utm_source=5134448...');
}
};
xhr.send();
});- api.positionbox.com
Receives the active tab URL and visitor IP for geolocation lookup. Third-party service; no disclosed data retention policy in the extension's store listing.
Extension branded as VPN routes all buttons to affiliate links
This extension advertises a free VPN with 'Get Free VPN' and 'Hide My IP' buttons, but has no VPN, proxy, or tunneling code.
Every button opens zenmate.com with the developer's affiliate ID; the developer earns a commission per install.
You click 'Get Free VPN' or 'Hide My IP' expecting VPN protection to activate.
The popup displays these buttons prominently alongside your current IP address and geolocation data, strongly implying the buttons will protect you.
A new tab opens to zenmate.com with the developer's affiliate tracking parameters, no proxy, tunnel, or IP change occurs.
Your IP address and browsing traffic remain entirely unchanged. The extension earns an affiliate commission if you install ZenMate.
All action buttons resolve to the same ZenMate affiliate URL
// ALL three interactive buttons resolve to the same ZenMate affiliate URL.
// No VPN, proxy, PAC script, webRequest rule, or network tunnel exists anywhere.
// Button 1 ('Check Custom IP') — popup.js:13-31
function init() {
document.getElementById('js_btn_check_custom_ip').addEventListener('click', function() {
// Affiliate URL with developer's tracking IDs hardcoded
var affiliateUrl = 'https://zenmate.com/?utm_medium=affiliate&utm_source=5134448&media_source=CJ_affiliates&AFFILIATE=5134448&cjevent=a2acd7dd761311ed801fb5ca0a18ba74';
var ip = document.getElementById('js_inp_custom_ip').value;
if (validateIPaddress(ip)) {
chrome.tabs.create({ url: affiliateUrl + ip }); // Opens ZenMate, not a VPN
}
});
}
// Buttons 2 ('Hide My IP') and 3 ('Get Free VPN') — popup.js:45-48
// Set to the same affiliate URL after the geolocation XHR completes
document.getElementById('js_btn_your_ip_show_on_map').setAttribute('href', affiliateUrl);
document.getElementById('js_btn_show_on_map').setAttribute('href', affiliateUrl);| Field | Value | Why it matters | |
|---|---|---|---|
Advertised: VPN / proxy | "fast, secure, unlimited, free VPN Proxy for Chrome" (manifest description) | The listing claims a 'fast, secure, unlimited, free VPN Proxy for Chrome', but no proxy config, PAC script, or tunneling code exists. | |
Actual function: affiliate redirect | https://zenmate.com/?utm_medium=affiliate&utm_source=5134448&media_source=CJ_affiliates&AFFILIATE=5134448 | Every action button opens zenmate.com with the developer's affiliate ID, earning a commission per click-through. |
- zenmate.com
ZenMate VPN, the extension's developer earns a commission (affiliate ID 5134448, CJ Affiliates network) when users install ZenMate after clicking through.
What it can do
Permissions this extension asks for, as declared in version 2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
See the address and title of every tab you have open
tabs