737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
- ID
- 13537
- Status
- summarized
- Published
- 12 Aug 2026, 10:09 PM
- Fetched
- 12 Aug 2026, 11:38 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.0
- Created
- 12 Aug 2026, 11:43 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
737 free Chrome VPN and proxy extensions across 40+ developer accounts were found routing users' entire browser sessions through a single SOCKS5 proxy on port 1082, giving the operator adversary-in-the-middle visibility into destinations, source IPs, TLS SNI values, and plaintext HTTP bodies. 274 of these impersonated 66 real VPN brands including NordVPN, Proton VPN, and ExpressVPN; 221 have been removed but 516 remain active on the Chrome Web Store with 75,486 total installs.
Why it matters
If you or your team uses a free Chrome VPN extension, check it against the list of 737 identified extensions — 516 are still live and can intercept all non-loopback browser traffic including API calls and credentials sent over plain HTTP. Builders who use browser-based VPNs for testing geo-restricted APIs or bypassing regional blocks should switch to system-level VPNs or verified provider apps instead of store extensions.
Discussion angle
How to audit your own and your team's Chrome extensions — the impersonation of 66 real brands means even name recognition is no longer a trust signal, and the 516 still-active extensions are a live risk for anyone doing dev work through a browser proxy.