Urban Vpn Proxy

What This Extension Does

The Urban VPN Proxy extension claims to provide a free VPN service, allowing users to access blocked content on the web.

Permissions Explained

• webRequestAuthProvider: Allows the extension to authenticate and authorize requests made by the user.

- Standard for VPN extensions.

• offscreen: Enables the extension to run in the background even when not visible.

- Unusual; typically used for tasks that don't require a UI, but this could be necessary for VPN functionality.

• alarms: Allows the extension to schedule and manage alarms (e.g., notifications).

- Standard for extensions with user-facing features.

• management: Grants the extension permission to manage other extensions or browser settings.

- Unusual; typically used by browser management tools, not VPNs.

• proxy: Enables the extension to act as a proxy server for web requests.

- Expected for a VPN extension.

• scripting: Allows the extension to execute scripts in the context of web pages.

- Standard for extensions that interact with web content.

• storage: Grants the extension permission to store data locally on the user's device.

- Standard for extensions that need to remember settings or cache data.

• tabs: Enables the extension to access and manipulate tabs in the browser.

- Standard for extensions that interact with web pages.

• webNavigation: Allows the extension to observe and modify navigation events (e.g., page loads).

- Expected for a VPN extension, as it needs to intercept and redirect traffic.

• webRequest: Enables the extension to inspect and modify web requests made by the user.

- Expected for a VPN extension.

• privacy: Grants the extension permission to access privacy-related features of the browser.

- Unusual; typically used by extensions that focus on privacy, not VPNs.

• <all_urls>: Allows the extension to access all URLs, including those with sensitive information.

- Critical risk due to its broad scope and potential for misuse.

• https://*.bugsnag.com/*: Grants the extension permission to communicate with Bugsnag's servers.

- Expected for an extension that uses Bugsnag for error reporting.

What We Found in the Code

• innerHTML assignment: This flag is likely a normal coding pattern, as innerHTML can be used safely when rendering UI elements from trusted sources. However, it could potentially introduce an XSS vector if user-provided data is not properly sanitized.
• Makes HTTP requests: This is a standard behavior for extensions that need to communicate with servers or APIs.

External Connections

The extension communicates with the following domains:

• www.w3.org, v3-migration.vuejs.org, github.com, vuejs.org (likely for development or dependency purposes)
• api-pro.urban-vpn.com, authentication.urban-vpn.com, anti-phishing-protection.urban-vpn.com, www.urban-vpn.com (expected for VPN functionality and user authentication)
• tinyurl.com, www.cloudflare.com (likely for URL shortening or CDN services)
• notify.bugsnag.com (expected for error reporting)

Things to Consider

Given the extension's purpose, it seems that some permissions are expected (e.g., proxy, webRequest). However, others seem broader than necessary (e.g., management, privacy). The critical risk associated with <all_urls> is concerning, as this permission could potentially be used for malicious purposes. Users should carefully evaluate whether an extension with such broad access to their browsing data is necessary and trustworthy.