Is Helper VPN safe?

Helper VPN can hand its stored proxy username and password to any website that issues an HTTP Basic auth challenge.

When you set a username and password for Helper VPN's proxy server, the extension saves them in local storage. Its auth-request handler responds to every HTTP Basic/Digest authentication prompt on any site with those saved credentials, without checking whether the prompt actually came from the VPN proxy. A site that simply returns its own 401 Basic-auth challenge can trigger Chrome to send the stored VPN credentials to it.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.