Chrome VPN Extensions Route Traffic Through State‑Controlled Proxies

Hundreds of free VPN and proxy extensions have been discovered on the Chrome Web Store that intercept browser traffic and route it through external proxy servers. A study uncovered 737 such extensions, primarily targeting Russian‑speaking users who seek access to blocked services ¹.

The malicious extensions were published by at least 40 different developer accounts on the store, amassing roughly 75 486 installations worldwide ¹. Among these, investigators identified 274 instances that impersonated 66 distinct legitimate extension names, effectively tricking users into installing them under the guise of trusted tools ¹.

Once installed, each extension rewrites HTTP headers and redirects outbound requests to a remote proxy network. The traffic is then sent over encrypted tunnels but ultimately exits from IP addresses located in Russia or its satellite jurisdictions, allowing state actors to monitor, filter, or alter content before returning it to the user’s device ¹. This mechanism bypasses typical end‑to‑end encryption expectations for “free” VPNs and undermines privacy guarantees advertised by mainstream providers.

Experts note that this pattern mirrors known proxy hijacking schemes used to funnel data through infrastructure controlled by governments with censorship mandates. Similar tactics have previously enabled large spyware deployments, including NSO Group’s Pegasus suite, which has been linked to surveillance of journalists, activists, and political dissidents around the world ¹. By routing traffic through Russian‑controlled proxies, attackers can inspect URLs, inject malware, or harvest credentials without triggering conventional detection mechanisms.

The scale of the compromise raises significant concerns for everyday users who rely on Chrome extensions for anonymity. Even though the extensions claim to provide free VPN services, they lack the rigorous security audits required for reputable providers; instead, they expose sensitive browsing habits to potentially hostile entities. Users should verify the publisher’s identity, review permissions requested, and consider disabling or uninstalling any extension that offers “unlimited” bandwidth or claims zero cost.

Given the volume of affected installations, browser vendors may need to reassess their extension vetting processes. The store could implement stricter scrutiny for extensions that modify network requests or require elevated privileges. Meanwhile, IT administrators in corporate environments should audit installed extensions across endpoints and enforce policies disallowing unauthorized VPN tools.

These findings underscore how seemingly innocuous add‑ons can become conduits for state‑level eavesdropping. Privacy is not guaranteed by brand names alone but hinges on transparent, audited code paths. Vigilance remains essential as malicious actors continue to exploit open ecosystems for covert data collection.