🟠 High | Source: The Hacker News
737 free VPN and proxy extensions on the Chrome Web Store were found to secretly route users’ browser traffic through attacker-controlled proxy infrastructure, primarily targeting Russian-speaking users. The extensions, spread across 40 developer accounts, amassed over 75,000 installs and many impersonated legitimate tools. This creates significant risk of traffic interception, credential theft, and data exfiltration.
Security Architect’s Take: Audit your organisation’s managed Chrome browser policies to block unapproved extensions using the ExtensionInstallBlocklist or allowlist controls via Chrome Enterprise. Consider enforcing a zero-trust approach where only explicitly approved browser extensions can be installed on corporate devices, and review existing installs against the published list of affected extensions.
Original advisory: 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One