Is Troywell VPN safe?

Question

Accepted Answer

Troywell VPN is high risk. Free VPN for Chrome (Troywell) downloads a server-controlled list of extension IDs from its own server on every startup. Using special Chrome browser permissions, it can remotely turn off any other extensions on your machine — including ad blockers, password managers, or privacy tools — without asking you first. A second config (called “terminator”) downloads ad-blocking rules that selectively bypass the VPN’s own filters, so the server can decide exactly which ads you see. Code analysis of v5.0.5 shows the extension shipping with a domain-rotation loop that lets the developer move every troywell.org call (telemetry, configuration, kill-switch fetches, affiliate registration) onto a different host at runtime, without publishing a new extension version. On every service-worker startup the extension calls https://ext.troywell.org/api/vpn/hasupdateddomain/<your-extension-id>; the response can extend the active domain list. A wrapper around fetch then rewrites the literal string "troywell.org" in any caller-supplied URL to whatever host is currently active. We observed this live during dynamic analysis: in a 232-second sterile run the extension stored the rotation state {"domainList":["troywell.org","troywell.io","llewyort.org"],"domainChanges":false} into chrome.storage.local and issued 144 requests to troywell.io alongside 145 to troywell.org, 4 to cdn.troywell.io, and 110 to cdn.translations.troywell.io. The third entry, llewyort.org, is not a literal in the extension source; it was added by the server response. Practical effect: any blocklist or detection rule that targets troywell.org alone will without notifying the user miss the same traffic flowing through whatever domain the operator decides to rotate to next.

Is Free VPN for Chrome - Troywell VPN safe?

Findings