If you installed a free VPN extension from the Chrome Web Store recently, there is a real chance it was not protecting your traffic — it was selling it. Researchers have identified 737 Chrome extensions marketed as VPN tools that were quietly routing user traffic through third-party proxy networks, often without any meaningful disclosure to the people who installed them. The findings, first reported by The Hacker News, represent one of the largest coordinated extension-based proxy schemes ever documented in the Chrome ecosystem.
This is not a fringe problem. Chrome extensions sit in one of the most privileged positions on your device — they can read page content, intercept requests, and in this case, silently redirect network traffic. For anyone concerned about cloud data exposure, this is the kind of quiet, unglamorous vulnerability that causes real damage long before anyone notices.
737 Extensions, One Playbook
The extensions shared a common architecture: they enrolled users’ browsers as residential proxy nodes, effectively turning everyday internet connections into exit points that third-party services could route traffic through. Residential proxies are highly valuable because they appear to originate from real consumers rather than data centers, making them harder to block and more useful for scraping, ad fraud, and bypassing geographic restrictions. By installing what looked like a privacy tool, users were unknowingly providing that infrastructure.
The scale is striking. Seven hundred thirty-seven extensions across a single browser platform suggests a coordinated supply operation rather than isolated bad actors. Many of the extensions had thousands of installs, and their listings used standard VPN marketing language — encrypted tunnels, no-log policies, anonymous browsing — without disclosing the proxy enrollment. In practice, the opposite of privacy was being delivered.
What the Proxy Scheme Actually Does to You
Routing your traffic through a residential proxy network has compounding risks beyond the obvious privacy violation. Your IP address becomes associated with the browsing behavior of whoever is paying to use that proxy exit point. If that traffic involves scraping, fraud, or anything flagged by a platform’s abuse detection system, the consequences trace back to your connection. Users have no visibility into what is moving through their node or who is on the other end of the transaction.
The monetization model behind these extensions is well established in the proxy-as-a-service industry. Companies sell residential bandwidth by the gigabyte, and browser extensions are among the cheapest ways to build that network. Developers can earn recurring revenue by embedding a proxy SDK — sometimes a single library — into an otherwise functional extension. The user gets a free VPN that technically changes their apparent IP address. The developer gets paid for every gigabyte of traffic brokered through the user’s machine. Everyone wins except the person who thought they were getting privacy software.
Google has taken action against extension-based abuse before, but the Chrome Web Store’s review process has historically struggled to catch SDK-level behavior that only activates after installation. The 737-extension figure suggests that gap remains wide open. Users should audit their installed extensions immediately, removing any free VPN tools they cannot trace to a verifiable, established provider. Checking extension permissions — specifically any that touch network requests or proxy settings — is the fastest triage step available right now.
The broader lesson here connects to a pattern researchers have flagged repeatedly: free browser extensions are an underregulated attack surface, and the privacy tools category is a particularly attractive cover. Treat your extension list like your app permissions. If you cannot identify the company behind it, uninstall it first and ask questions later.
