StreamTube Proxy: Remote-Controlled YouTube Proxy Routing Through Operator Server

Overview

StreamTube Proxy is a Chrome extension that unblocks YouTube by routing all requests to YouTube, ytimg.com, and gemini.google.com through a third-party proxy server. The extension uses a PAC script installed via the proxy permission. Every request to those domains is sent to the hardcoded proxy 193.233.165.68:63228, while all other traffic goes DIRECT. With 100,000 users, the operator of that proxy can observe the YouTube browsing activity of a large user base.

The extension is not malicious in the traditional sense: no credential theft, code injection, or data exfiltration is present in the first-party code. The risk stems from the operator's control over the proxy infrastructure and the ability to change the proxy destination remotely.

How it works

The background script (background.js:1) returns the proxy rule:

return "PROXY 193.233.165.68:63228";

This rule is applied only to YouTube-related domains. All other requests bypass the proxy:

return "DIRECT";

The proxy server list and API base URL are not hardcoded entirely. The extension fetches a remote configuration from https://raw.githubusercontent.com/vpn-naruzhu/public/main/uboost-extension:

fetch("https://raw.githubusercontent.com/vpn-naruzhu/public/main/uboost-extension").then(o=>o.json()).then(n=>...)

The current remote config returns:

{
  "apiBaseUrl": "uubb.website",
  "currentVersion": "6.2.1",
  "requiredVersion": "6.2.1",
  ...
}

Whoever controls the GitHub repository vpn-naruzhu/public can update this file to change the proxy server, API base URL, or required version at any time, without needing to update the extension itself. This gives the operator persistent remote control over the extension's behavior.

The extension requests only two permissions: proxy and storage (manifest.json:9). No host permissions are declared for arbitrary sites, but the proxy permission allows the PAC script to intercept and redirect requests to any host if the script changes. Currently, the scope is limited to YouTube domains.

Payload

The payload is observational: the operator's proxy sees the destination metadata (domain, path, query parameters) of all YouTube requests. Because YouTube uses HTTPS, the proxy cannot decrypt the content, but it can still see which videos, channels, and searches a user accesses. The operator could also modify the remote config to expand the proxied domains to include more sites, turning the extension into a broader surveillance tool.

No malicious behavior was found in the current code. The extension does not evaluate remote code, does not read cookies or credentials, and does not exfiltrate data beyond the inherent proxy traffic. However, the remote configuration introduces a supply-chain risk: a compromise of the GitHub repository or the operator's infrastructure could redirect users to a malicious proxy or inject additional rules.

Store status

As of this writing, StreamTube Proxy remains active on the Chrome Web Store with approximately 100,000 users. The extension has not been removed or flagged by Google. Users who value privacy should remove the extension, as it gives a third party visibility into their YouTube activity. If the extension is required for regional unblocking, consider using a VPN instead, which provides end-to-end encryption and does not expose browsing metadata to an unknown proxy operator.