Is Urban Safe Browsing safe?
Urban Safe Browsing sends all-site navigation details and request/response metadata to Urban VPN safe-browsing servers.
When safe browsing is enabled after policy agreement, the extension observes HTTP and HTTPS page navigations across sites. It sends a compressed payload containing URLs, page titles, referrers, request and response headers, tab details, and IP-related response metadata to Urban VPN's safe-browsing endpoint.
Who publishes itUrban Cyber Security INC - 3 other listings from the same operator, 3 of them carrying a finding
Urban Cyber Security INC - 3 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 7.3M+ users between them. 3 of them carry a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Navigation metadata is posted to Urban VPN safe-browsing servers.
When you opt in to Urban Safe Browsing, the extension sends navigation records to Urban VPN's safe-browsing endpoint, including URLs, page titles, referrers, request and response headers, tab details, and IP-related metadata.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user completes the required safe-browsing policy action.
The extension collects all-site navigation clickstream, request metadata, and response metadata, compresses it, and posts it to Urban VPN safe-browsing servers.
- Browsing historyhttps://example.com/account (illustrative)
Shows the sequence of sites and pages visited while the extension is active.
- Page URLhttps://news.example/article?id=123 (illustrative)
Identifies the specific page loaded or embedded in a frame.
- Page titleExample Account Settings (illustrative)
Can reveal the topic or account context of the visited page.
- Referrerhttps://search.example/results?q=travel (illustrative)
Shows the page or site that led to the current navigation.
- Request and response headersUser-Agent: Chrome; Content-Type: text/html (illustrative)
May include browser, language, cache, content, and server metadata associated with a navigation.
- Tab and frame detailstabId 42, frameId 0 (illustrative)
Connects each navigation to a browser tab, frame, and page context.
- IP address metadata203.0.113.10 (illustrative)
Associates the navigation record with network-level response details.
Dynamic analysis confirmed the extension grants all-site host access, hooks request and response header events, maps those values into navigation payloads, enables full-navigation compression, and posts to the checkSafety endpoint.
Where it sends data
Destinations our analysis observed Urban Safe Browsing contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- protection-toolbar.urban-vpn.com
Urban Safe Browsing sends data to protection-toolbar.urban-vpn.com. One other extension we have analysed sends data here.