Is VPN United Kingdom - Planet VPN lite Proxy safe?
The extension decrypts proxy credentials with a hardcoded AES key and can disable other installed browser extensions.
The extension fetches proxy configuration from vqols.cc and decrypts the returned credentials client-side using a hardcoded 256-bit AES key embedded in background.js. It also enumerates all installed browser extensions on every popup open and offers to disable any that hold proxy permissions, which may include legitimate security tools. Proxy authentication is triggered by making an HTTP request to api.telegra.ph with a randomised path suffix.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup open reads installed proxy extensions
Opening the popup, its startup code reads your installed extensions via Chrome's management API, keeping entries that are enabled, have proxy permission, and aren't this extension, before you click anything.
You open the extension popup.
The popup immediately checks installed extensions and records enabled proxy-capable matches.
| Field | Value | Why it matters | |
|---|---|---|---|
Installed extension type | extension | Shows whether another installed item is a browser extension rather than a theme or other component. | |
Enabled state | true | Shows whether another extension is currently active in your browser. | |
Proxy access | proxy | Shows whether another extension can affect proxy settings, which reveals part of your security or privacy setup. | |
Extension identifier | bihmplhobchoageeokmgbdihknkjbknd | Lets the extension distinguish one installed add-on from another and exclude its own ID from the conflict list. |
Popup startup invokes the installed-extension conflict check
return Ln(async () => {
t.getConnectionStatusLS(), n.getServers(), n.getCurrentServer || n.getServers(), i.reviewModalStatus(_n.CHECK_MODAL_STATUS), s.checkConflictedExtensions(), r.checkConsentStatus(), a.getLocation();
const l = await o.checkingErrors(),
c = await o.checkingServersError();
l && i.openModal(st.RES_ERROR), c && i.openModal(st.SERVERS_ERROR)
}), (l, c) => {async checkConflictedExtensions() {
qn.management.getAll(e => {
this.conflictedExtensions = e.filter(t => t.type === "extension" && t.enabled === !0 && t.permissions?.indexOf("proxy") !== -1 && t.id !== qn.runtime.id), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !0)
})
}When another enabled proxy-capable extension is present, the popup stores it as a conflict and can show that state in the interface.
Popup conflict store state{
"conflictedStatus": true,
"conflictedExtensions": [
{
"id": "bihmplhobchoageeokmgbdihknkjbknd",
"type": "extension",
"enabled": true,
"permissions": [
"proxy"
]
}
]
}Conflict prompt can disable other proxy extensions
Finding another enabled extension with proxy permission, the conflict prompt offers a button for Chrome users.
Clicking it makes the popup iterate the stored conflict list and call Chrome's management API to disable each listed extension.
You click the conflict prompt after another proxy-capable extension has been listed.
The extension disables each listed extension by ID.
| Field | Value | Why it matters | |
|---|---|---|---|
Other extension ID | bihmplhobchoageeokmgbdihknkjbknd | Identifies the extension that can be turned off after the prompt button is clicked. | |
Enabled state | true | Only active extensions are added to the conflict list, so inactive extensions are skipped by this path. | |
Proxy permission | proxy | Shows that the extension can affect browser proxy settings, which may include VPN, privacy, or security add-ons. |
Conflict modal button calls the disable routine
disableConflictedExtensions() {
this.conflictedExtensions.forEach(e => {
qn.management.setEnabled(e.id, !1)
}), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !1)
}function n() {
Ps === We.FIREFOX ? t.howToDisableExtensions() : t.disableConflictedExtensions()
}
return (s, r) => (ie(), ue("div", q_, [r[0] || (r[0] = v("img", {
src: z_,
alt: "logo"
}, null, -1)), v("h2", null, X(s.$t("modals.conflict.title")), 1), v("p", null, X(s.$t("modals.conflict.text-1")), 1), v("p", null, X(s.$t("modals.conflict.text-2")), 1), v("button", {
class: "btn btn--primary",
onClick: n
}, X(T(Ps) === T(We).FIREFOX ? s.$t("modals.conflict.button-firefox") : s.$t("modals.conflict.button-chrome")), 1)]))| When | You did | Extension did |
|---|---|---|
| On button click | extension An enabled extension with proxy permission is present in the conflict list. | extension The extension calls Chrome to set that extension to disabled. |