FoxyProxy browser extension: proxy switching rebuilt for Manifest Version 3

A twenty year old tool forced to rewrite itself

The readme tells the story in one paragraph, and it explains the whole shape of the project.

After some years of stability, FoxyProxy has been updated to support Manifest Version 3, which the readme says is required by Chrome in order for extensions to be compatible with Chrome in 2024. The team then took advantage of this forced update to implement many feature requests and other changes that had been requested over the years.

That is the key fact for anyone evaluating this repository. This is not a new extension that happens to be Manifest V3. It is a mature, long-lived tool that had to be re-plumbed to keep working in Chrome, and the maintainers used the disruption to fold in a backlog.

Continuity is stated plainly as well: FoxyProxy has been owned and developed consistently by the same team since 2006. The repository holds the source code for version 8.0 and above, for Firefox, Chrome and other Chromium based browsers such as Chromium, Brave and Edge. Source code for older versions lives in a separate firefox-extension repository.

The releases track that. The listed versions are v9.8 from 2026-09-14, v9.7 from 2026-08-13 and v9.6 from 2026-08-05, and the last push to the repository was on 2026-09-14. The project description notes it is version 8 and above, and the readme describes the current rewrite as having happened after years of stability.

So the extension in a browser today is a different piece of software from the one that ran in 2016, built by the same people for the same purpose. That is a good combination for a tool whose job is to sit in your browser and control network settings.

Four standing permissions and three optional ones

The permissions section is the most useful part of the readme for anyone deciding whether to install this, because a proxy extension asks for a lot.

The four required permissions are listed with the reason for each. Download files and read and modify the browser's download history, used to save and export user preferences to a file for backup or sharing. Display notifications to you, used to inform users, for example about errors. Control browser proxy settings, described as the core function of the extension. Access browser tabs, used to get tab details, for example for the Tab Proxy feature.

The optional permissions are the interesting half, because the readme is explicit that they are only requested when the user asks for them. Clear recent browsing history, cookies and related data, for the Delete Browsing Data button, which deletes cookies, indexedDB and localStorage, only if requested by the user. Read and modify privacy settings, for the Limit and Toggle WebRTC features, again only if requested. And access your data for all websites, used to set proxies and provide authentication, which the readme calls the core function of the extension.

That last one deserves a second look. The host permission for all sites is the price of doing the job, since a proxy decision that applies per pattern has to be made on every request, and proxy authentication has to be injected into requests. There is no way to run a proxy switching extension without it. But the fact that the readme distinguishes it as optional rather than required suggests it is requested at the moment the user turns on a feature that needs it, which is the pattern that lets a user grant the minimum.

The distinction between the required and optional groups is the practical thing to check against your own threat model, and the readme is unusually clear about which is which.

No remote code, stated as a property of the extension

There is a short section under Remote Code, and it contains a single sentence: no remote code is used in this extension.

That sentence carries a lot of weight in the extension ecosystem, and the reason is structural rather than editorial. Chrome's extension review process and its store policies place restrictions on extensions that download and then execute code, because an extension that can fetch and run arbitrary JavaScript at runtime can change its own behaviour after the store has reviewed it. A proxy extension that needed to pull updated logic from a server would be in a different category of risk from one that does not.

So for FoxyProxy, the behaviour of the extension is fixed by the code in the repository and the build that produced the store package. The permissions it requests are the permissions it will ever have, and the code it runs is the code a reviewer can read. For a tool that sits between you and every request your browser makes, that is a meaningful property, and stating it in the readme rather than leaving it implicit is a sign of how the project treats it.

The related documentation is in the repository. There is a PRIVACY.md file at the top level alongside a FAQ.md and a CONTRIBUTING.md, and the readme links to an About page carrying the changelog and a Help page, both hosted on the project documentation site.

The same site hosts the source of the pages themselves, since the screenshots and the about page live under a src/content path in the published documentation.

Two editions, three browsers, one repository

The releases section of the readme is a table, and the table shows that FoxyProxy ships in more than one form.

There is a Standard edition and a Basic edition. The Standard edition is published for Chrome, Firefox and Edge, with a link to the Chrome Web Store entry, the Mozilla add-ons entry and the Microsoft Edge add-ons entry. The Basic edition has Chrome and Firefox entries but no Edge entry in the table, so the Edge build is a Standard only distribution.

The Firefox entry for Standard additionally carries a recommended extension badge, which is Mozilla's own designation. That is worth reading as a statement from the browser vendor rather than from the project, and it is unusual enough to mention.

The build is shared across the three browsers. The repository is a single source tree at src/, and the same code is built for Firefox, Chrome and other Chromium based browsers including Chromium, Brave and Edge. The readme's phrasing is that the repository has the source code for version 8.0 and above for all of them, with older versions in a separate repository.

The ECMAScript badge in the header says the code targets ECMAScript 2022, which is ES13. The repository layout is a classic extension source tree rather than a modern bundler project: a Gruntfile.js at the root, a src/ directory, a screenshots/ directory, and a package.json whose entire devDependencies list is grunt, grunt-cli and grunt-contrib-compress.

That last point is informative about the build. There is no webpack, no rollup, no babel and no framework. The Grunt setup is used to build and to compress the extension packages for distribution, and the absence of a dependency tree beyond Grunt itself means the extension ships with no third party runtime code, which is consistent with the no remote code claim and with the extension being auditable in full.

What the interface looks like from the screenshots

The readme does not describe the user interface in words, but the screenshot section gives an unusually clear picture of it, because the file names carry the structure.

There are two themes, dark and light, and each theme shows the same six surfaces: a popup, an options tab, a proxies tab, an import tab, a pattern tester tab and a log tab. The screenshots are labelled under the 8.1 directory, which is a useful detail, because the readme is about version 8 and above while the current release is 9.8, so the images show a layout from a specific point in the 8 series rather than the newest one.

The tab names map onto the actual capabilities of the tool, and they tell you what the extension does beyond switching a proxy. There is a proxies tab, which is where the list of servers lives. There is an import tab, which lines up with the readme's permission to export and save user preferences to a file for backup or sharing, and with the import of proxy lists. There is a pattern tester tab, which is the tool for checking a proxy pattern against a URL before you rely on it, and pattern based routing is the reason a proxy manager like this exists rather than a single setting in the browser. There is a log tab, for the history of what the extension did.

The popup is the quick surface and the options tab is the settings surface, which is the standard split for a browser extension.

The Tab Proxy feature named in the permissions section is the other clue to the scope: the extension can decide which proxy a given tab uses, not just the browser as a whole. That is a workflow tool for people who work with several network routes at once, and the pattern tester and log tabs are what you would want alongside it.

Where FoxyProxy is the wrong tool

There are clear boundaries, and they are worth stating before you install it.

The first is that this is a client for proxies you already have. Nothing in the readme describes bundled proxy servers, a subscription service, or a list of working endpoints. A proxy management extension routes your traffic to a server that somebody else operates, and the security of that traffic is the security of that server and its configuration. If you are looking for a way to browse without a VPN, this is the wrong category of tool.

The second is the policy one. Proxy switching is something many organisations prohibit outright, and the permissions involved, host access for all websites, proxy control and download history, are exactly the set that a security review will look at closely. The readme documents them well, which helps, but documentation is not authorisation.

The third is the Manifest Version 3 constraint itself. The rewrite was forced by Chrome, and it brings Chrome's background service worker model rather than a persistent background page. The readme does not describe the consequences for the features the old version had, and it does not document the differences between the Standard and Basic editions in terms of which features are present. If you rely on a specific capability, you should check the Help page rather than assume parity with the pre-8 extension.

The fourth is the release cadence versus the source layout. The published packages are built by the maintainers and are in the stores, but the repository's build tooling is a Gruntfile with a single compression plugin and no unit test or lint configuration in the devDependencies. That means the repository is a source of truth for reading and for building your own package, not a package you would fork and extend with a full engineering setup. The older versions sit in a separate repository, so a diff against a pre-8 release is not something the current tree supports.

On the alternative, the difference in approach is between a browser extension and a system level proxy configuration. A system proxy, whether through the operating system settings or a local client application, applies to every application rather than only the browser, and it is not subject to extension store policies or per-extension permission prompts. The extension route wins on granularity and on the fact that it lives inside the browser, giving per pattern rules and per tab switching with no system configuration. The system route wins on coverage and on the fact that there is no third party extension with access to your requests in the first place. Which is right depends entirely on whether you want proxying for the browser alone or for the machine.

Editorial conclusion

FoxyProxy suits a user who needs per pattern or per tab proxy switching and wants the extension to be auditable rather than a closed binary, and it does not suit an organisation that bans proxy software by policy, since the extension exists to route traffic through a proxy you choose. Before you install it, read the permission list the extension actually requests, since the readme documents four standing permissions and three optional ones, and check which store build you are taking, because the Standard and Basic editions differ and only Standard is published for Edge.

Frequently asked questions

Official sources

1. foxyproxy/browser-extension on GitHub
2. Issues
3. License: GPL-2.0
4. README
5. Releases