Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: TOR Browser Extension

CRITICAL RISK

TOR Browser Extension

ID: lefoggeccdgcmbcooppiamikhklnnddj

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Active

Version

2.1

Size

6.57 MB

Rating

1.6/5

Reviews

Users

5,000

Type

Extension

Updated

Sep 19, 2023

Publisher Contextual Analysis

Author: mattrhorn-officialView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,001

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Tor for browsers, one click start.

Quickly use the internet, while connected to the TOR secure network! With the TOR Browser Extension, anyone can use the TOR network on any browser compatible, without any need for additional installations or hassle. Connect to country exit nodes with TOR VPN such as Germany and the United States. Stop yourself from getting tracked, hacked and having your data stolen, while routing your Traffic Through TOR. Important note: this addon does NOT belong or relate to Tor® project and has NO affiliations with Tor® anonymity software or website at all. It is basically an unofficial extension that is developed and maintained independently by its author. We cannot guarantee your privacy or safety, if you need a perfect application please use the TOR Browser for android.

User Growth

Showing data from Sep 19, 2023 to Sep 17, 2024

Versions

-66.67%(-6,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 9 ratings

Average Rating

Current: 1.44 / 5.0+1.44

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.1 Code review	6

Extension Version	Code Review Findings
2.1	6

Files with findings

3 distinct paths — top paths by unique finding count:

src/scripts.js4
manifest.json1
src/search.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	src/scripts.js (line 59)	The extension is marketed as a TOR Browser Extension that gives access to the Tor network and .onion sites, but the PAC script unconditionally routes ALL user web traffic through a single hardcoded SOCKS5 proxy at 164…	2.1
2	Network Interception	critical	src/scripts.js (line 89)	The PAC script explicitly carves out extensionpay.com to go DIRECT while forcing every other host through the attacker-controlled SOCKS5 proxy. The whitelist is not a privacy feature — it ensures the payment provider …	2.1
3	Phishing	critical	manifest.json (line 1)	Manifest requests the 'proxy' permission and broad host access (http:/// and https:///) under the name 'TOR Browser Extension', then uses scripts.js as a service worker to install a PAC script that hijacks all traff…	2.1
4	Credential Theft	high	src/scripts.js (line 1)	Source contains a hardcoded plaintext credential pair ([email protected] / TOR-VPN27) for an external service in a top-of-file comment. Beyond the obvious credential leak, this provides strong attribution for th…	2.1
5	Other	high	src/scripts.js (line 115)	The 'off' state does not restore the user's normal direct connection; it installs a PAC script that points all traffic to 'SOCKS5 blackhole:80', which silently breaks browsing rather than disabling the proxy mode. Com…	2.1
6	Other	high	src/search.js (line 325)	The 'Global (Auto) TOR' country entry maps to country code '850', which is then concatenated with the prefix '91' or '9' in scripts.js to produce a port number on the single hardcoded proxy IP 164.92.123.128. There is…	2.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	http://*/
*	-	https://*/
developer.mozilla.org	/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
github.com	/mozilla/webextension-polyfill/issues/130	https://github.com/mozilla/webextension-polyfill/issues/130
extensionpay.com	-	https://extensionpay.com
extensionpay.com`;	-	https://extensionpay.com`;
stackoverflow.com	/a/68456858	https://stackoverflow.com/a/68456858
developer.mozilla.org	/en-US/docs/Web/API/Window/open	https://developer.mozilla.org/en-US/docs/Web/API/Window/open
github.com	/Glench/ExtPay	https://github.com/Glench/ExtPay#2-configure-your-manifestjson

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


144.126.212.105	IPv4	-
164.92.123.128	IPv4	-

1.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

paywalled

下ら

下凡ノら凡乚·3 Jul 2026

I paid it works BUT you have to be on a whitelisted site

Tammy Clayton·26 Jun 2026

Бесполезное

Iwan Eboshin·26 May 2026

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

TOR Browser Extension

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating