Is VPN Japan - Planet VPN lite Proxy safe?

Medium risk

VPN Japan - Planet VPN lite Proxy decrypts proxy credentials using a hardcoded key and can silently disable competing extensions.

The extension fetches proxy server credentials from vqols.cc and decrypts them using an AES-256 key bundled in the extension source, meaning anyone who extracts the extension can recover those credentials. When connecting to the VPN, it also sends a network probe to api.telegra.ph on every activation. Additionally, the extension enumerates all installed extensions and offers a one-click action to disable any that hold the proxy permission, without showing the user which specific extensions will be affected.

Free VPN Planetv1.0.13Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Conflict prompt disables other proxy extensions

VPN Japan - Planet VPN lite Proxy uses the management permission to list extensions, select enabled ones requesting proxy access, and disable matches on the conflict modal's button click; it's one bulk action, not per-extension.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click the single action button in the extension's conflict prompt.

The extension did this

The extension disables other enabled extensions that also request proxy access.

02EvidenceFIELD TABLE
Installed-extension fields used to decide what gets disabled
FieldValueWhy it matters
Extension type
extensionOnly browser extensions are considered for the bulk disable action.
Enabled state
trueOnly currently enabled extensions are selected, so the action changes active browser behavior.
Proxy access
proxyExtensions that can control proxy settings are selected as conflicts.
Extension ID
hipncndjamdcmphkgngojegjblibadbeThis value identifies which installed extension will be disabled.
03EvidenceCODE COMPARE
The code that does this

The conflict store enumerates and disables matching extensions

What it actually does
Readable popup bundlepopup.js
Yc = an("conflicts", {
  state: () => ({
    conflictedExtensions: [],
    conflictedStatus: !1
  }),
  getters: {
    getConflictedStatus: e => e.conflictedStatus
  },
  actions: {
    async checkConflictedExtensions() {
      qn.management.getAll(e => {
        this.conflictedExtensions = e.filter(t => t.type === "extension" && t.enabled === !0 && t.permissions?.indexOf("proxy") !== -1 && t.id !== qn.runtime.id), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !0)
      })
    },
    disableConflictedExtensions() {
      this.conflictedExtensions.forEach(e => {
        qn.management.setEnabled(e.id, !1)
      }), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !1)
    },
    howToDisableExtensions() {
      it(Ee.firefoxDisableExt())
    }
  }
})
04EvidenceCODE COMPARE
The code that does this

The modal button invokes the bulk disable path

What it actually does
Readable modal componentpopup.js
q_ = {
  class: "conflict"
},
W_ = Ie(ye({
  __name: "ModalConflicts",
  setup(e) {
    const t = Yc();

    function n() {
      Ps === We.FIREFOX ? t.howToDisableExtensions() : t.disableConflictedExtensions()
    }
    return (s, r) => (ie(), ue("div", q_, [r[0] || (r[0] = v("img", {
      src: z_,
      alt: "logo"
    }, null, -1)), v("h2", null, X(s.$t("modals.conflict.title")), 1), v("p", null, X(s.$t("modals.conflict.text-1")), 1), v("p", null, X(s.$t("modals.conflict.text-2")), 1), v("button", {
      class: "btn btn--primary",
      onClick: n
    }, X(T(Ps) === T(We).FIREFOX ? s.$t("modals.conflict.button-firefox") : s.$t("modals.conflict.button-chrome")), 1)]))
  }
}), [
  ["__scopeId", "data-v-a52eef79"]
])
Manifest permissionmanifest.json
"permissions": [
  "proxy",
  "storage",
  "webRequest",
  "webRequestAuthProvider",
  "management",
  "offscreen"
]

Data recipients

vqols.ccapi.telegra.ph
Updated 17 September 2026jonfefokggbliacanjbaiejmbclccocp