Popular Chrome VPN extension caught secretly spying on users — uninstall it right now

Chrome browser on laptop — (Image credit: Shutterstock)

A VPN is a common and recommended privacy tool when going online which is why many people download them as either apps for their computer or smartphone or as extensions for their browser of choice. However, not every VPN is trustworthy or even remains that way. Case in point, FreeVPN.One is a Chrome extension with 100,000 installs, a 3.8 star rating and even a verified badge. However, several recent updates have changed the status of the extension from safe to very suspicious.

As reported by Cybernews, researchers at Koi Security recently put out a report detailing their findings on the extension complete with a timeline that showed how it has shifted to spying on its users instead of protecting their privacy. This was done by taking screenshots of their displays and sending this data back to remote servers. When a webpage is loading, the extension will grab a screenshot in the background and then send it back to a server with additional details like the URL, tab ID number and a unique user identifier.

One of the features of the extension is “Scan with AI Threat Detection” which is intended to upload screenshots and URLs when the user clicks a ‘check URL’ button, however, there is no indication to the user that the extension has been repeatedly grabbing screenshots in the background even when this feature is not being used.

VPN extensions need some permissions to operate on a user’s system – usually proxy and storage permissions. However, FreeVPN.One required suspiciously more access including all URLs, tabs and scripting permissions. The researchers at Koi Security pointed out that this, in addition to the other issues the extension exhibited, opened the door to persistent surveillance of its users.

A developer is not named in either the privacy policy or the Terms of Service on the FreeVPN.One website, and their explanations to the security researchers about their findings do not match. According to the researchers: “The [developer] explained that the automatic screenshot capture is part of a Background Scanning feature, which should only trigger if a domain appears suspicious. In practice, we saw screenshots being captured on trusted services like Google Sheets and Google Photos, domains that cannot be considered suspicious” and the developer ceased communications when asked to provide proof of legitimacy.

Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.

More from Tom's Guide

Any Contract Length

1 Month Contracts

12 Months Contracts

24 Months Contracts

Showing 10 of 15 deals

Filters☰

Private Internet Access 24 Month

Private Internet Access 1 Month

TOPICS

Amber Bouman is the senior security editor at Tom's Guide where she writes about antivirus software, home security, identity theft and more. She has long had an interest in personal security, both online and off, and also has an appreciation for martial arts and edged weapons. With over two decades of experience working in tech journalism, Amber has written for a number of publications including PC World, Maximum PC, Tech Hive, and Engadget covering everything from smartphones to smart breast pumps.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.