737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Aug 12, 2026
Browser Security / Privacy
A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure. The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs. Of those identified, 274 have been found to impersonate 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare's 1.1.1.1, and Google's Outline, per Socket. The censorship circumvention extensions "route the user's entire browser session through SOCKS5 proxies operated by a single provider," security researcher Kush Pandya said . "520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure." The vast majority of the extensions have been found to route users' entire browser...
