By newsbot | Published on 20-08-2025 19:30 | Categories: News
Extensions in Google Chrome can be very useful for the functionality of the browser. VPN extensions have always been popular in the Chrome Web Store. While VPNs are generally intended for maintaining anonymity, can also be very problematic if they are used to spy on you. That's exactly what's happening with a Chrome VPN extension with hundreds of thousands of users.
A post by Koi Security explains how the FreeVPN.One Chrome extension tracks its users.
See more articles from iGuRu.gr when you search for news on Google.
How does it do this? It secretly captures screenshots as users navigate from one website to another. These screenshots are taken through a sophisticated mechanism that gives the user no indication of what is happening.
Screenshots are captured exactly 11 seconds after a page loads, which ensures that the content is fully rendered before being stolen.
Koi Security also reports that the extension requires too many permissions and asks for location and device information upon launch. It sends all of this data to a server. The security team says that the FreeVPN.One extension was initially harmless, and that the developer began embedding malicious code in April 2025. The latest version, 3.1.4, released on July 25, encrypts stolen data in transit with AES-256 to hide what it is sending.
When Koi Security contacted the developer of FreeVPN.One, he said that automatic screenshots are taken for suspicious domains. However, it was observed that screenshots are even taken for mainstream domains like Google Photos and Google Sheets.
The developer also stressed that the feature is currently enabled by default, but will be disabled in a future update. He also claimed that screenshots are not kept or sold for financial gain, but when asked to provide evidence, he stopped responding to emails.
