Is Jego - Free VPN for Gemini, ChatGPT, and Copilot safe?

High risk

Jego is high risk. Observed during dynamic analysis: on install the extension read a DNS TXT record for v3.jego.club and used the returned address as its first backend URL. The server list can change without an extension update.

Jegov1.5.12Chrome Web Store
74Risk
Who publishes it

Jego - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Jego
Website
jegocloud.com/terms

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

doh.360.cn
Also called by 3 other listings, including JetStream VPN, 自由最快最稳妥, FlashVPN - 安全,快速,便捷的代理!
common.dot.dns.yandex.net
Also called by 4 other listings, including Free VPN For Chrome & Ad blocker - Planet VPN, Red Shield VPN, Red Shield VPN

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Backend server addresses can be changed via DNS TXT records and session replies

Observed during dynamic analysis: on install the extension read a DNS TXT record for v3.jego.club and used the returned address as its first backend URL.

The server list can change without an extension update.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The extension is installed and its service worker starts.

The extension did this

It looks up a DNS TXT record and uses the answer as its first backend address.

The record is controlled by whoever runs the v3.jego.club zone.

The code that does this

DNS-over-HTTPS TXT lookup and stored-domain prepend

Readable version

TXT query against both resolvers

worker.js
const res = await fetch(server + "?type=16&name=" + encodeURIComponent(domain), { mode: "cors", signal: controller.signal });if (!res.ok) return [];const data = await res.json();return data && Array.isArray(data.Answer) ? data.Answer.map(function(a) {  return a && a.data;}) : [];

Session reply feeds the same list

worker.js
if (sessionData.local_api_domains) {  save_local_api_domains(sessionData.local_api_domains);}
Captured request
GEThttps://223.5.5.5/resolve?type=16&name=v3.jego.club

TXT answer data: https://47.106.228.226:2090. That URL became first in chrome.storage.local urls and the /chrome/session POST was then sent to it (status 200).

Hosts involved in endpoint selection
    • 223.5.5.5

    Public DNS-over-HTTPS resolver queried for the TXT record.

    • 223.6.6.6

    Second public DoH resolver, queried in parallel.

    • v3.jego.club

    Domain whose TXT record supplies backend URLs.

    • 47.106.228.226

    Backend address returned by the TXT record during testing.

    • keyhuawei.com

    Hardcoded default backend, also contacted for the session POST.

What it can do

Permissions this extension asks for, as declared in version 1.3.22. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.5.12, which we have not unpacked yet.

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Route all of your browsing through a server of its choosing

    proxy

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

Updated 15 October 2026bnnamacamhjbdoimlbkegmbgkekphcbb