Is VPN Japan - Planet VPN lite Proxy safe?

Medium risk

VPN Japan - Planet VPN lite Proxy decrypts proxy credentials using a hardcoded key and can silently disable competing extensions.

The extension fetches proxy server credentials from vqols.cc and decrypts them using an AES-256 key bundled in the extension source, meaning anyone who extracts the extension can recover those credentials. When connecting to the VPN, it also sends a network probe to api.telegra.ph on every activation. Additionally, the extension enumerates all installed extensions and offers a one-click action to disable any that hold the proxy permission, without showing the user which specific extensions will be affected.

Free VPN Planetv1.0.13Chrome Web Store
45Risk
Who publishes it

FREE VPN PLANET SRL - 11 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Free VPN Planet
Declared legal entity
FREE VPN PLANET SRL
Registered address
Bulevardul Dimitrie Pompeiu 5, București, București 020335, RO
Registered contact
Planet VPN
Website
freevpnplanet.com/contact-us/

Same store account

11 other listings published from this account, 3.4M+ users between them. 2 of them carry a finding.

Planet Search2.0M+CleanFree VPN For Chrome & Ad blocker - Planet VPN1.0M+MediumVPN USA - Planet VPN lite Proxy200k+LowVPN India - Planet VPN lite Proxy100k+LowVPN United Kingdom - Planet VPN lite Proxy30k+MediumVPN Turkey - Planet VPN lite Proxy30k+Clean5 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

vqols.cc
Also called by 3 other listings, including Free VPN USA - Planet VPN Proxy
cdn.freevpnplanet.com
Also called by 6 other listings, including Free VPN USA - Planet VPN Proxy, Dymo, Free VPN Proxy & Ad Blocker - Planet VPN

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Conflict prompt disables other proxy extensions

MediumunwantedCWE-506Dynamic sandbox

VPN Japan - Planet VPN lite Proxy uses the management permission to list extensions, select enabled ones requesting proxy access, and disable matches on the conflict modal's button click; it's one bulk action, not per-extension.

What actually happens

You did this

You click the single action button in the extension's conflict prompt.

The extension did this

The extension disables other enabled extensions that also request proxy access.

Installed-extension fields used to decide what gets disabled

  • Extension type
    extension

    Only browser extensions are considered for the bulk disable action.

  • Enabled state
    true

    Only currently enabled extensions are selected, so the action changes active browser behavior.

  • Proxy access
    proxy

    Extensions that can control proxy settings are selected as conflicts.

  • Extension ID
    hipncndjamdcmphkgngojegjblibadbe

    This value identifies which installed extension will be disabled.

The code that does this

The conflict store enumerates and disables matching extensions

Readable version

Readable popup bundle

popup.js
Yc = an("conflicts", {  state: () => ({    conflictedExtensions: [],    conflictedStatus: !1  }),  getters: {    getConflictedStatus: e => e.conflictedStatus  },  actions: {    async checkConflictedExtensions() {      qn.management.getAll(e => {        this.conflictedExtensions = e.filter(t => t.type === "extension" && t.enabled === !0 && t.permissions?.indexOf("proxy") !== -1 && t.id !== qn.runtime.id), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !0)      })    },    disableConflictedExtensions() {      this.conflictedExtensions.forEach(e => {        qn.management.setEnabled(e.id, !1)      }), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !1)    },    howToDisableExtensions() {      it(Ee.firefoxDisableExt())    }  }})

The code that does this

The modal button invokes the bulk disable path

Readable version

Readable modal component

popup.js
q_ = {  class: "conflict"},W_ = Ie(ye({  __name: "ModalConflicts",  setup(e) {    const t = Yc();    function n() {      Ps === We.FIREFOX ? t.howToDisableExtensions() : t.disableConflictedExtensions()    }    return (s, r) => (ie(), ue("div", q_, [r[0] || (r[0] = v("img", {      src: z_,      alt: "logo"    }, null, -1)), v("h2", null, X(s.$t("modals.conflict.title")), 1), v("p", null, X(s.$t("modals.conflict.text-1")), 1), v("p", null, X(s.$t("modals.conflict.text-2")), 1), v("button", {      class: "btn btn--primary",      onClick: n    }, X(T(Ps) === T(We).FIREFOX ? s.$t("modals.conflict.button-firefox") : s.$t("modals.conflict.button-chrome")), 1)]))  }}), [  ["__scopeId", "data-v-a52eef79"]])

Manifest permission

manifest.json
"permissions": [  "proxy",  "storage",  "webRequest",  "webRequestAuthProvider",  "management",  "offscreen"]

Where it sends data

Destinations our analysis observed VPN Japan - Planet VPN lite Proxy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • vqols.cc

    VPN Japan - Planet VPN lite Proxy sends data to vqols.cc. 6 other extensions we have analyzed send data here.

  • api.telegra.ph

    VPN Japan - Planet VPN lite Proxy sends data to api.telegra.ph. 5 other extensions we have analyzed send data here.

Updated 30 September 2026jonfefokggbliacanjbaiejmbclccocp