SecureProxy is critical risk. Pressing Connect makes SecureProxy install a mandatory PAC-script proxy sampling 10 of 50 hardcoded hosts per connection on port 443. Chrome reported it extension-controlled; navigations failed with ERR_MANDATORY_PROXY_CONFIGURATION_FAILED. Clicking Connect rewires HTTP/HTTPS requests through one of 50 hardcoded proxy servers. The proxy is mandatory, so Chrome can't fall back if unreachable. Ten hosts are random per connection; visited URLs and headers pass through them.

Is SecureProxy - Free & Unlimited VPN safe?

Critical risk

SecureProxy is critical risk. Pressing Connect makes SecureProxy install a mandatory PAC-script proxy sampling 10 of 50 hardcoded hosts per connection on port 443. Chrome reported it extension-controlled; navigations failed with ERR_MANDATORY_PROXY_CONFIGURATION_FAILED.…

developmentstudent12v1.0.2Chrome Web Store

100Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityCRITICAL

ClassUNWANTED

TypeUnexpected

CWECWE-200

SourceAI SANDBOX

Mandatory proxy routing for browser traffic

Pressing Connect makes SecureProxy install a mandatory PAC-script proxy sampling 10 of 50 hardcoded hosts per connection on port 443.

Chrome reported it extension-controlled; navigations failed with ERR_MANDATORY_PROXY_CONFIGURATION_FAILED.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You press the Connect button in the SecureProxy popup.

The popup sends a runtime message with action set to connect.

The extension did this

The extension changes Chrome's proxy settings so non-localhost browsing uses selected hardcoded proxy hosts.

It stores the connected state and active host list after applying the PAC script.

02EvidenceNETWORK CAPTURE

Captured request

GETgoldenearsvccc.space:443

Chrome reported levelOfControl='controlled_by_this_extension', mode='pac_script', mandatory=true; navigations to wikipedia.org, amazon.com, and reddit.com failed with ERR_MANDATORY_PROXY_CONFIGURATION_FAILED after activation.

03EvidenceFIELD TABLE

Data and state affected by the proxy setting

Field	Value	Why it matters
Browsing destinations	wikipedia.org, amazon.com, reddit.com	The proxy path can see the sites your browser tries to reach while the connection is active.
Non-localhost web traffic	https://www.wikipedia.org/	Your browser is instructed to send ordinary web requests through the selected proxy hosts instead of going direct.
Selected proxy hosts	efr-marktplatz.club, www.donelikeyester.space, www.passportsusa.space	The extension records which remote hosts are currently carrying the proxy connection.
Connection state	connectionStatus: connected	The extension stores whether the proxy is connected, so it can report and restore that state.

04EvidenceSTORAGE DUMP

What's stored on your device

After activation, Chrome storage records that the proxy is connected and keeps the current proxy host list.

Locationchrome.storage.local keys 'connectionStatus' and 'activeHosts'

Contents (JSON)

{
  "activeHosts": [
    "goldenearsvccc.space",
    "pagecloud.space",
    "projectorpoint.website"
  ],
  "connectionStatus": "connected"
}

05EvidenceCODE COMPARE

The code that does this

The popup command reaches the proxy-setting code path

What it actually does

Show shipped source

Popup sends the connect commandassets/index-BxfuHDbF.js

const u = () => {
  var g;
  if (n) return;
  r(!0);
  const p = e ? "disconnect" : "connect";
  (g = chrome == null ? void 0 : chrome.runtime) != null && g.sendMessage ? chrome.runtime.sendMessage({
    action: p
  }, w => {
    w && w.success ? t(w.status.isConnected) : console.error("Error en VPN:", w == null ? void 0 : w.error), r(!1)
  }) : (t(!e), r(!1))
}

Service worker handles the connect messagejs/background.js

chrome.runtime.onMessage.addListener((t, e, o) => ((async () => {
  switch (console.log("Mensaje recibido:", t), t.action) {
    case "connect":
      const s = await A(),
        n = await chrome.storage.local.get(["connectionStatus", "activeHosts"]);
      o({
        success: s.success,
        error: s.error,
        status: {
          isConnected: n.connectionStatus === "connected",
          activeHosts: n.activeHosts || []
        }
      });
      break;
    case "disconnect":
      const d = await u(),
        g = await chrome.storage.local.get(["connectionStatus", "activeHosts"]);
      o({
        success: d.success,
        error: d.error,
        status: {
          isConnected: g.connectionStatus === "connected",
          activeHosts: g.activeHosts || []
        }
      });
      break;
    case "getStatus":
      const h = await chrome.storage.local.get(["connectionStatus", "activeHosts"]);
      o({
        success: !0,
        status: {
          isConnected: h.connectionStatus === "connected",
          activeHosts: h.activeHosts || []
        }
      });
      break;
    case "getHosts":
      o({
        success: !0,
        hosts: l.getAllHosts()
      });
      break;
    case "rotate":
      const y = await v(),
        p = await chrome.storage.local.get(["connectionStatus", "activeHosts"]);
      o({
        success: y,
        cycleInfo: m(),
        status: {
          isConnected: p.connectionStatus === "connected",
          activeHosts: p.activeHosts || []
        }
      });
      break;
    case "getCycleInfo":
      o({
        success: !0,
        cycleInfo: m()
      });
      break;
    default:
      o({
        success: !1,
        error: "Acción no reconocida"
      })
  }
})(), !0));

06EvidenceCODE COMPARE

The code that does this

The PAC script routes non-localhost traffic through selected hosts

What it actually does

Show shipped source

PAC configuration builderjs/background.js

class T {
  constructor(e) {
    this.hosts = e
  }
  getHosts(e) {
    return [...this.hosts].sort(() => .5 - Math.random()).slice(0, Math.min(e, this.hosts.length))
  }
  getConfigForHosts(e) {
    return {
      value: {
        mode: "pac_script",
        pacScript: {
          data: `
      function FindProxyForURL(url, host) {
        if (host === 'localhost' || shExpMatch(host, '127.0.0.1')) {
          return 'DIRECT';
        }
        return '${e.map(n=>`HTTPS ${n}:443`).join("; ")}';
      }
    `.trim(),
          mandatory: !0
        }
      }
    }
  }
  getAllHosts() {
    return this.hosts
  }
}

Connect applies the PAC script and stores statejs/background.js

async function A() {
  console.log("Iniciando conexión al proxy...");
  try {
    const t = l.getHosts(10),
      e = l.getConfigForHosts(t);
    return await chrome.proxy.settings.set(e), await chrome.storage.local.set({
      connectionStatus: "connected",
      activeHosts: t
    }), console.log("Proxy conectado exitosamente con hosts:", t), await w(!0), {
      success: !0,
      hosts: t
    }
  } catch (t) {
    return console.error("Error al conectar proxy:", t), await u(), {
      success: !1,
      error: t.message
    }
  }
}

07EvidenceTHIRD PARTY LIST

Hardcoded proxy host candidates in version 1.0.4

efr-marktplatz.club
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
voteshirleysew.club
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
carolinafreigh.fun
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
purposebydesig.club
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
mmgr.club
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
webdrone.club
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
ictabernacle.info
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
jewelscollecti.icu
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
berniesbodybla.fun
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
fullmanfirm.icu
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
miamigoskennel.fun
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
goedkoopgeluid.icu
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
tzoa.fun
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
kimberlymilano.icu
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
crosscards.site
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
jgwynphotoarts.pro
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
indextraub.online
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
purecambogiasl.live
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
zebpay.site
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
southwestcoast.pro
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.mohegansuncasi.online
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.hullwiper.live
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.anokhiiwade.info
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.tecnopay.online
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.i-mopachores.live
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.wpfaststart.info
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.art1p.pro
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.roccosiffredi.online
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.saifrizvi.live
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.rmtonthebeach.info
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.donelikeyester.space
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.yoakumselfstor.website
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.passportsusa.space
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.uatgc.website
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.ahikeleher.site
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.helpinghandsof.space
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.onedaijo.website
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.templarknights.site
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.aoeah.space
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.stratfordrc.website
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.all4women.space
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.keukataxi.website
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.carimflex.site
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.peacefulbodies.xyz
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.vogelsenmeer.xyz
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.9ts3tpia.world
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.ruimte-18.xyz
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.nogielectric.world
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.bodrumexpresso.xyz
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.
www.jaqandlelights.world
Candidate HTTPS proxy host; the connection flow can select it for the PAC script.

SeverityCRITICAL

ClassUNWANTED

TypeUnexpected

CWECWE-506

SourceAI SANDBOX

Extension routes all browser traffic through 50 hardcoded proxy servers

Clicking Connect rewires HTTP/HTTPS requests through one of 50 hardcoded proxy servers.

The proxy is mandatory, so Chrome can't fall back if unreachable.

Ten hosts are random per connection; visited URLs and headers pass through them.

01EvidenceCODE COMPARE

Unknown block kind: code_compare

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "code_compare",
  "caption": "PAC script generation and mandatory proxy installation",
  "language": "js",
  "shipped": [],
  "deobfuscated": []
}

02EvidenceTHIRD PARTY LIST

All 50 hardcoded proxy domains

efr-marktplatz.club
Proxy endpoint, all browser traffic routed through port 443
voteshirleysew.club
Proxy endpoint, all browser traffic routed through port 443
carolinafreigh.fun
Proxy endpoint, all browser traffic routed through port 443
purposebydesig.club
Proxy endpoint, all browser traffic routed through port 443
mmgr.club
Proxy endpoint, all browser traffic routed through port 443
webdrone.club
Proxy endpoint, all browser traffic routed through port 443
ictabernacle.info
Proxy endpoint, all browser traffic routed through port 443
jewelscollecti.icu
Proxy endpoint, all browser traffic routed through port 443
berniesbodybla.fun
Proxy endpoint, all browser traffic routed through port 443
fullmanfirm.icu
Proxy endpoint, all browser traffic routed through port 443
miamigoskennel.fun
Proxy endpoint, all browser traffic routed through port 443
goedkoopgeluid.icu
Proxy endpoint, all browser traffic routed through port 443
tzoa.fun
Proxy endpoint, all browser traffic routed through port 443
kimberlymilano.icu
Proxy endpoint, all browser traffic routed through port 443
crosscards.site
Proxy endpoint, all browser traffic routed through port 443
jgwynphotoarts.pro
Proxy endpoint, all browser traffic routed through port 443
indextraub.online
Proxy endpoint, all browser traffic routed through port 443
purecambogiasl.live
Proxy endpoint, all browser traffic routed through port 443
zebpay.site
Proxy endpoint, all browser traffic routed through port 443
southwestcoast.pro
Proxy endpoint, all browser traffic routed through port 443
www.mohegansuncasi.online
Proxy endpoint, all browser traffic routed through port 443
www.hullwiper.live
Proxy endpoint, all browser traffic routed through port 443
www.anokhiiwade.info
Proxy endpoint, all browser traffic routed through port 443
www.tecnopay.online
Proxy endpoint, all browser traffic routed through port 443
www.i-mopachores.live
Proxy endpoint, all browser traffic routed through port 443
www.wpfaststart.info
Proxy endpoint, all browser traffic routed through port 443
www.art1p.pro
Proxy endpoint, all browser traffic routed through port 443
www.roccosiffredi.online
Proxy endpoint, all browser traffic routed through port 443
www.saifrizvi.live
Proxy endpoint, all browser traffic routed through port 443
www.rmtonthebeach.info
Proxy endpoint, all browser traffic routed through port 443
www.donelikeyester.space
Proxy endpoint, all browser traffic routed through port 443
www.yoakumselfstor.website
Proxy endpoint, all browser traffic routed through port 443
www.passportsusa.space
Proxy endpoint, all browser traffic routed through port 443
www.uatgc.website
Proxy endpoint, all browser traffic routed through port 443
www.ahikeleher.site
Proxy endpoint, all browser traffic routed through port 443
www.helpinghandsof.space
Proxy endpoint, all browser traffic routed through port 443
www.onedaijo.website
Proxy endpoint, all browser traffic routed through port 443
www.templarknights.site
Proxy endpoint, all browser traffic routed through port 443
www.aoeah.space
Proxy endpoint, all browser traffic routed through port 443
www.stratfordrc.website
Proxy endpoint, all browser traffic routed through port 443
www.all4women.space
Proxy endpoint, all browser traffic routed through port 443
www.keukataxi.website
Proxy endpoint, all browser traffic routed through port 443
www.carimflex.site
Proxy endpoint, all browser traffic routed through port 443
www.peacefulbodies.xyz
Proxy endpoint, all browser traffic routed through port 443
www.vogelsenmeer.xyz
Proxy endpoint, all browser traffic routed through port 443
www.9ts3tpia.world
Proxy endpoint, all browser traffic routed through port 443
www.ruimte-18.xyz
Proxy endpoint, all browser traffic routed through port 443
www.nogielectric.world
Proxy endpoint, all browser traffic routed through port 443
www.bodrumexpresso.xyz
Proxy endpoint, all browser traffic routed through port 443
www.jaqandlelights.world
Proxy endpoint, all browser traffic routed through port 443

03EvidenceTEMPORAL PATTERN

When this fires

On every browser startup

On each browser startup the service worker checks chrome.storage.local for a saved connectionStatus. If the value is 'connected' and activeHosts is non-empty, it calls chrome.proxy.settings.set() with the previously selected host set, restoring the mandatory proxy without any user interaction.