Is Ping Network VPN safe?

Medium risk

Ping Network VPN computes a browser/device fingerprint in the popup and sends its components to pingvpn.xyz.

When the popup runs, it builds a Thumbmark value from browser and device signals such as user agent, platform, hardware concurrency, canvas, WebGL, audio, fonts, and plugins, then posts the value and component details to https://pingvpn.xyz/v1/. The extension stores the last reported thumbmark locally and reports changes to the same Ping VPN API.

Ping Networkv1.3.13Chrome Web Store
50Risk
Who publishes it

Ping Network - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Ping Network
Website
pingnetwork.io/support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup reports browser fingerprint components to Ping VPN backend

When you open the Ping Network VPN popup, the extension computes a browser/device fingerprint using Thumbmark signals, then sends the fingerprint and component details to https://pingvpn.xyz/v1/ as storage-related fingerprint data.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens or uses the extension popup.

The extension did this

The popup computes a Thumbmark browser and device fingerprint and reports its components to the Ping VPN backend.

Captured request
POSThttps://pingvpn.xyz/v1/
Fields in the request
  • Stored fingerprint data
    thumbmark.report with thumbmark_components (illustrative)

    The extension stores and reports Thumbmark fingerprint data and component details that can distinguish a browser/device across popup uses.

Observation

Dynamic analysis confirmed that the popup reaches the thumbmark reporting path and posts a thumbmark.report request to the configured Ping VPN API endpoint.

What it can do

Permissions this extension asks for, as declared in version 1.3.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Route all of your browsing through a server of its choosing

    proxy

  • Watch every request your browser makes

    webRequest

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

Where it sends data

Destinations our analysis observed Ping Network VPN contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • pingvpn.xyz

    Ping Network VPN sends data to pingvpn.xyz. No other extension we have analysed sends data here.

Updated 30 September 2026geeedmdpncfeomhgbjeafcahepjelimg