Is Freezen MateVPN Chrome safe?

High risk

Freezen MateVPN for Chrome is high risk. Every time you open the popup, it reads the active tab URL and sends it in a plain-HTTP GET to api.positionbox.com, a third-party geolocation service, automatically before you interact. The listing calls it a VPN tool, not mentioning it.…

FreeToolsv2.1Chrome Web Store
75Risk
Who publishes it

FreeTools - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
FreeTools

Same store account

2 other listings published from this account, 30k+ users between them, none of them carrying a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

zenmate.com
Also called by 3 other listings, including CyberGhost VPN Free Proxy, ZenMate Free VPN

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Active tab URL sent to positionbox.com on every popup open

Every time you open the popup, it reads the active tab URL and sends it in a plain-HTTP GET to api.positionbox.com, a third-party geolocation service, automatically before you interact.

The listing calls it a VPN tool, not mentioning it.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the extension popup.

No further interaction is required, the request fires on DOMContentLoaded.

The extension did this

Your active tab's URL is sent to api.positionbox.com via an unencrypted HTTP GET request.

The request includes your IP address and the full URL of the page you are visiting as a query parameter.

02EvidenceNETWORK CAPTURE
Captured request
GEThttp://api.positionbox.com/?module=Chrome&action=getIPGeoLocation&url=https://mail.google.com/mail/u/0/#inbox
Returns JSON with positionbox.request.ip (visitor IP), positionbox.website.ip, positionbox.website.url, and geolocation fields (city, country, latitude, longitude).
03EvidenceFIELD TABLE
Data transmitted to api.positionbox.com
FieldValueWhy it matters
Current page URL
https://mail.google.com/mail/u/0/#inboxThe full address of the tab you have open, reveals the sites you visit, including paths and query strings.
Your IP address
203.0.113.47Your public IP address is visible to positionbox.com from the HTTP connection itself.
04EvidenceCODE COMPARE
The code that does this

URL collection and transmission, popup.js lines 35-59

What it actually does
chrome.tabs.query({'active': true, 'lastFocusedWindow': true}, function (tabs) {
    var url = tabs[0].url;  // Active tab URL captured here

    var xhr = new XMLHttpRequest();
    // Tab URL appended as query parameter; plain HTTP — no TLS
    xhr.open("GET", "http://api.positionbox.com/?module=Chrome&action=getIPGeoLocation&url=" + url, true);
    xhr.onreadystatechange = function() {
        if (xhr.readyState == 4) {
            var resp = JSON.parse(xhr.responseText);
            // Response populates display fields and rewrites button hrefs to ZenMate affiliate URLs
            document.getElementById('js_tab_geolocation_your_ip').innerHTML = resp.positionbox.request.ip;
            document.getElementById('js_btn_your_ip_show_on_map').setAttribute('href', 'https://zenmate.com/?utm_medium=affiliate&utm_source=5134448...');
            document.getElementById('js_tab_website_ip').innerHTML = resp.positionbox.website.ip;
            document.getElementById('js_btn_show_on_map').setAttribute('href', 'https://zenmate.com/?utm_medium=affiliate&utm_source=5134448...');
        }
    };
    xhr.send();
});
05EvidenceTHIRD PARTY LIST
Data destination
  • api.positionbox.com

    Receives the active tab URL and visitor IP for geolocation lookup. Third-party service; no disclosed data retention policy in the extension's store listing.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Extension branded as VPN routes all buttons to affiliate links

This extension advertises a free VPN with 'Get Free VPN' and 'Hide My IP' buttons, but has no VPN, proxy, or tunneling code.

Every button opens zenmate.com with the developer's affiliate ID; the developer earns a commission per install.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click 'Get Free VPN' or 'Hide My IP' expecting VPN protection to activate.

The popup displays these buttons prominently alongside your current IP address and geolocation data, strongly implying the buttons will protect you.

The extension did this

A new tab opens to zenmate.com with the developer's affiliate tracking parameters, no proxy, tunnel, or IP change occurs.

Your IP address and browsing traffic remain entirely unchanged. The extension earns an affiliate commission if you install ZenMate.

02EvidenceCODE COMPARE
The code that does this

All action buttons resolve to the same ZenMate affiliate URL

What it actually does
// ALL three interactive buttons resolve to the same ZenMate affiliate URL.
// No VPN, proxy, PAC script, webRequest rule, or network tunnel exists anywhere.

// Button 1 ('Check Custom IP') — popup.js:13-31
function init() {
    document.getElementById('js_btn_check_custom_ip').addEventListener('click', function() {
        // Affiliate URL with developer's tracking IDs hardcoded
        var affiliateUrl = 'https://zenmate.com/?utm_medium=affiliate&utm_source=5134448&media_source=CJ_affiliates&AFFILIATE=5134448&cjevent=a2acd7dd761311ed801fb5ca0a18ba74';
        var ip = document.getElementById('js_inp_custom_ip').value;
        if (validateIPaddress(ip)) {
            chrome.tabs.create({ url: affiliateUrl + ip });  // Opens ZenMate, not a VPN
        }
    });
}

// Buttons 2 ('Hide My IP') and 3 ('Get Free VPN') — popup.js:45-48
// Set to the same affiliate URL after the geolocation XHR completes
document.getElementById('js_btn_your_ip_show_on_map').setAttribute('href', affiliateUrl);
document.getElementById('js_btn_show_on_map').setAttribute('href', affiliateUrl);
03EvidenceFIELD TABLE
What the extension claims vs. what it does
FieldValueWhy it matters
Advertised: VPN / proxy
"fast, secure, unlimited, free VPN Proxy for Chrome" (manifest description)The listing claims a 'fast, secure, unlimited, free VPN Proxy for Chrome', but no proxy config, PAC script, or tunneling code exists.
Actual function: affiliate redirect
https://zenmate.com/?utm_medium=affiliate&utm_source=5134448&media_source=CJ_affiliates&AFFILIATE=5134448Every action button opens zenmate.com with the developer's affiliate ID, earning a commission per click-through.
04EvidenceTHIRD PARTY LIST
Affiliate destination
  • zenmate.com

    ZenMate VPN, the extension's developer earns a commission (affiliate ID 5134448, CJ Affiliates network) when users install ZenMate after clicking through.

What it can do

Permissions this extension asks for, as declared in version 2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026acjlblgibpeochegbmidehmaphkhdoec