Chrome Extension Off vs Direct Mode: Which Proxy Is Active

Your extension says Off, the toolbar icon is grey, and the browser still exits from somewhere unexpected. That is not a bug in Chrome's UI. An extension's Off button is an application label, and what it does underneath is one of several different proxy operations with different consequences. Before you toggle anything else, read the effective setting and its source, because the answer is already displayed.

Read the effective setting and who set it

Open chrome://net-internals/#proxy in the affected profile. The page shows the effective proxy configuration and, more usefully, the source that supplied it, which tells you whether you are looking at an extension, a system configuration, a policy or something built into the browser. Compare that against what the extension claims and the disagreement usually names the culprit immediately. This is a read-only step, so do it before changing any setting.

Then open chrome://policy and check for proxy-related policies. A managed policy outranks an extension's own setting, so an extension that reports itself as active can be effectively overruled while showing a perfectly honest status.

If both pages agree and the exit is still wrong, the remaining candidate is outside the browser.

Three operations that all look like Off

The proxy API exposes modes, not a single enabled flag. An extension can set direct mode, which means the browser uses no proxy for the connections it covers. It can set system mode, which hands the decision back to the operating system configuration. Or it can clear its own setting, which removes that setting and lets whatever else applies take over. Those are three different outcomes and only one of them means what a user thinks Off means.

The distinction matters because the label on the button was chosen by the extension's author, not by Chrome.

The proxy API reference documents direct and system mode and notes that system mode is not the same as leaving the configuration unset. That sentence is the whole article in one line.

Find the owner when layers disagree

Chrome merges settings from several sources, and precedence decides the winner rather than the order in which you clicked. Policy sits above extensions, and extensions sit above the operating system configuration, so a work-managed proxy can win while a personal extension looks inactive in its own popup. Read the effective value and its reported source instead of reasoning about the ladder from memory.

Disabling an extension, uninstalling it and clearing its setting are also three different actions, and only the last one explicitly removes what it stored.

Incognito adds a scope wrinkle. An extension can hold a separate setting for incognito windows, so a normal-window test proves nothing about a private window, and clearing one scope leaves the other intact.

What direct mode does not mean

Direct means no browser proxy at this API layer. It does not mean the connection bypasses an operating-system VPN, escapes a firewall, or becomes plaintext. If the device has a full-tunnel VPN, direct traffic still enters that tunnel, and the public address you observe will still be the VPN exit. Conflating the two produces the confusing case where a user disables the extension and sees no change at all.

Test the two layers separately: the browser's effective proxy source from the internal page, and the public address from both a browser request and a terminal command on the same machine.

Re-test one change at a time

Change one layer, then re-read the effective setting before testing anything else. Clearing a managed proxy to obtain a different exit is the step where a support investigation turns into a policy violation, so route that decision through whoever owns the policy. Record the before and after source values in the ticket; the next engineer will otherwise repeat the whole sequence.

A browser profile with three extensions, a company policy and a system proxy has four plausible owners, and only one of them is answering.