737 Chrome VPN Extensions Route Your Entire Browser Session Through One Proxy

Researchers have found 737 free Chrome VPN and proxy extensions that quietly route a user's entire browser session through a single provider's SOCKS5 proxy infrastructure, placing the operator in an adversary-in-the-middle position over everything the browser does. Published across at least 40 Chrome Web Store developer accounts with more than 75,000 combined installs, 274 of them impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare's 1.1.1.1. If you installed a free "VPN" extension to reach blocked services, check it now, because it may be forwarding your traffic to a stranger. Socket disclosed the cluster, which primarily targets Russian-speaking users seeking censorship circumvention.

The technical trick is mundane and that is what makes it effective. Each extension sets chrome.proxy.settings to a fixed SOCKS5 server, in most cases the same host on port 1082, and researchers found that 520 of 522 extensions in the bulk corpus route through the same infrastructure. From that position the operator can observe every destination the browser visits, the source IP, TLS SNI values that reveal the sites being reached, and the full body of anything sent over plain HTTP. The bypass list each extension ships includes only loopback addresses, so nothing the user does escapes the proxy.

It is worth being precise about what is and is not exposed, because the honest answer is bad enough without exaggeration. Standard HTTPS payloads stay encrypted unless the user was also tricked into installing a rogue root certificate. But the metadata, every visited domain via SNI, DNS lookups, connection timestamps, and source IP, is fully visible to whoever runs the proxy, and any plaintext HTTP request is readable in full. For a tool people install specifically for privacy, handing a single unknown operator a complete map of your browsing is the opposite of the promise.

How do I check whether I installed one of these extensions?

Open your Chrome extensions and scrutinize anything labeled VPN, proxy, or "unblock." Two signals matter most: whether it requests the proxy permission, and whether it actually came from the brand it claims. Legitimate vendors do publish official extensions, so verify the publisher (a verified badge and the vendor's real developer domain) or install from the vendor's primary site, rather than trusting a free lookalike that borrows the brand name. When in doubt, remove it, then confirm Chrome's proxy settings have returned to the system default. Any credentials you sent over plain HTTP while a rogue proxy was active should be treated as exposed; HTTPS logins stay protected unless you were also tricked into installing a rogue root certificate.

What should enterprises do about proxy extensions?

Stop treating extension installs as a user choice. Enforce an extension allowlist through Chrome Enterprise policy, Intune, or GPO (ExtensionInstallBlocklist: ["*"] with a curated ExtensionInstallAllowlist), so arbitrary proxy add-ons cannot be installed on managed endpoints at all. Audit for extensions requesting sensitive APIs such as proxy, webRequest, and <all_urls>, and monitor network egress for unexpected SOCKS5 traffic, including outbound connections to port 1082.

Our read

Understanding risk here means seeing the trust inversion. A VPN extension is installed to add privacy, and this class of extension does the reverse: it centralizes a user's entire browsing metadata in the hands of one unaccountable operator, under the brand of a company that never shipped it. For organizations, the lesson is that the browser is an unmanaged network device unless you manage it, and a permission like proxy is a data-exfiltration channel granted in one click. Allowlist what can run, audit what it can reach, and verify that continuously, because "it says VPN" is a claim, not a control.

Reporting by The Hacker News, citing Socket. Sources linked above.

Related: ModHeader extension pulled over a hidden data collector · Chrome 150 use-after-free memory-safety bugs