Is ExpressVPN: VPN proxy for a better internet safe?

Clean risk

ExpressVPN routes browser traffic through VPN servers and optionally replaces geolocation data with VPN server coordinates.

When connected, the extension tunnels network requests through ExpressVPN servers to mask the user's IP address. A content script injected on all pages can override the browser's geolocation API to report the VPN server's coordinates instead of the user's real location when the location-spoofing preference is enabled. Optional, opt-in usage telemetry sends an anonymous UUID, OS type, and VPN connection state to kape.dataplane.rudderstack.com via RudderStack.

ExpressVPNv8.0.11.1954Firefox Add-ons
0Risk
Who publishes it

ExpressVPN - no other listings under this identity, 8 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ExpressVPN
Website
www.expressvpn.com/get-browser-extension/?utm_source=mozilla_web_store&utm_medium=apps&utm_campaign=mozilla_web_store_listing&utm_content=website_link

Shared hosts - 8 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.jwks.kape.com
Also called by 2 other listings, including ExpressVPN
auth.expressvpn.com
Also called by 2 other listings, including ExpressVPN
cp.expressapisv2.net
Also called by 2 other listings, including ExpressVPN
expressv.typeform.com
Also called by 2 other listings
qm.cp.expressapisv2.net
Also called by 2 other listings
staging.api.jwks.kape.com
Also called by 2 other listings
stg.auth.xvtest.net
Also called by 2 other listings
xv-cp.apis-staging.xvtest.net
Also called by 2 other listings, including ExpressVPN

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 8.0.11.1954. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Route all of your browsing through a server of its choosing

    proxy

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Change your browser's privacy and security settings

    privacy

  • Watch every request your browser makes

    webRequest

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Watch, block and rewrite every request your browser makes

    webRequestBlocking

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

  • Show you desktop notifications

    notifications

Where it sends data

Destinations our analysis observed ExpressVPN: VPN proxy for a better internet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • kape.dataplane.rudderstack.com

    ExpressVPN: VPN proxy for a better internet sends data to kape.dataplane.rudderstack.com. No other extension we have analysed sends data here.

Updated 30 September 2026amo-817620