Is VPN VeePN - Free VPN for Firefox safe?
VPN VeePN enumerates all installed browser extensions and sends their names, IDs, and versions to an AWS endpoint on install and update.
On installation or update, the extension calls chrome.management.getAll() and sends each discovered extension's name, ID, version, and install type to an AWS Lambda endpoint operated by VeePN. Every analytics event also includes the user's IP address, country, region, OS and browser version, screen dimensions, timezone, and a persistent device UUID. Additionally, the extension can detect and disable other installed extensions that hold the proxy permission.
Who publishes itVeePN - no other listings under this identity, 16 shared hostnames
VeePN - no other listings under this identity, 16 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 16 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension Can Disable Other Proxy-Control Add-ons
Clicking the extension's proxy-conflict fix option lists enabled add-ons, identifies ones requesting proxy access, and disables each match via the extension-management permission.
This can turn off another VPN or proxy add-on.
What actually happens
You choose the extension's proxy-conflict fix from the popup.
The popup has controls for fixing a blocked proxy connection.
The extension finds enabled add-ons with proxy access and disables each match.
The code excludes its own add-on ID before applying the disable operation.
Installed add-on fields used by the disable path
- Installed add-on typeextension
Shows whether an installed item is a browser add-on that can be considered for the proxy-conflict flow.
- Proxy access flagpermissions includes proxy
Shows whether another add-on has the kind of access needed to control browser proxy settings.
- Enabled stateenabled: true
Shows whether the other add-on is currently active and therefore eligible to be turned off by this flow.
- Add-on identifierbihmplhobchoageeokmgbdihknkjbknd (illustrative)
Gives the extension a specific installed add-on to disable rather than only showing a general warning.
The code that does this
Background code that finds and disables proxy-capable add-ons
Readable filter and disable methods
assets/background.ts-DFouEIUW.jsstatic async getActiveExtensionsWithProxyPermition() { return (await r.management.getAll()).filter(n => n.type === "extension" && n.id !== r.runtime.id).filter(n => { const i = n.enabled, o = n.permissions?.includes("proxy"); return i && o })}async getProxyControlStatus() { const e = await r.tabs.query({ active: !0, currentWindow: !0 }).then(i => i.at(0)?.url), s = ["chrome://extensions", "about:addons", "edge://extensions", "opera://extensions"].some(i => e?.includes(i)); return { success: !0, data: { blocked: !(await this.proxyService.getControlProxyStatus()).status, "extensions-tab": s } }}async openExtensionsTab() { await Promise.resolve(this); const s = { chrome: "chrome://extensions", firefox: "about:addons", edge: "edge://extensions", opera: "opera://extensions" } ["firefox"]; return await r.tabs.create({ url: s }), { success: !0, data: { success: !0 } }}async disableProxyControlExtensions() { await Promise.resolve(this); const e = await Z.getActiveExtensionsWithProxyPermition(); return await Promise.all(e.map(t => r.management.setEnabled(t.id, !1))), { success: !0, data: { success: !0 } }}Readable message registration
assets/background.ts-DFouEIUW.js"get-proxy-control-status": this.getProxyControlStatus.bind(this),"open-extensions-tab": this.openExtensionsTab.bind(this),"disable-proxy-control-extensions": this.disableProxyControlExtensions.bind(this)The code that does this
Popup controls that send the disable message
Readable popup callbacks
assets/popup.html-dYpdzSuq.jsr = function() { sendMessageApp("send-analytic-event", { types: ["google-analytics", "amplitude", "aws-kinesis"], name: "extension_connection_blocked_another_extension_fix_for_me" }).catch(() => {}), sendMessageApp("disable-proxy-control-extensions").then(() => { e(), i(null) }).catch(() => {})}a = function() { sendMessageApp("send-analytic-event", { types: ["google-analytics", "amplitude", "aws-kinesis"], name: "extension_connection_blocked_another_extension_fix_myself" }).catch(() => {}), getProxyControlStatus().then(d => { d["extensions-tab"] ? i("turn-off") : i("instruction") }).catch(() => {})}o = function() { sendMessageApp("open-extensions-tab").catch(() => {})}l = function() { getProxyControlStatus().then(d => { d.blocked ? i("help") : (e(), i(null)) }).catch(() => {})}c = function() { sendMessageApp("disable-proxy-control-extensions").then(() => { e(), i(null) }).catch(() => {})}The code that does this
Manifest permission that allows installed-add-on management
"permissions": [ "storage", "proxy", "tabs", "cookies", "notifications", "webRequest", "webRequestAuthProvider", "privacy", "management"]What it can do
Permissions this extension asks for, as declared in version 5.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Route all of your browsing through a server of its choosing
proxy
See the address and title of every tab you have open
tabs
Read and change cookies, including the ones that keep you signed in
cookies
Show you desktop notifications
notifications
Watch every request your browser makes
webRequest
Change your browser's privacy and security settings
privacy
See, disable and uninstall your other extensions, including your security ones
management
Where it sends data
Destinations our analysis observed VPN VeePN - Free VPN for Firefox contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 1.1.1.1
VPN VeePN - Free VPN for Firefox sends data to 1.1.1.1. No other extension we have analyzed sends data here.
- l7hs5ym3xsnfrchbfwycmd2rou0aqhzl.lambda-url.us-west-2.on.aws
VPN VeePN - Free VPN for Firefox sends data to l7hs5ym3xsnfrchbfwycmd2rou0aqhzl.lambda-url.us-west-2.on.aws. No other extension we have analyzed sends data here.
- veepn.com
VPN VeePN - Free VPN for Firefox sends data to veepn.com. No other extension we have analyzed sends data here.