Am I Being Pwned?
Get started

Is VPN United Kingdom - Planet VPN lite Proxy safe?

Medium risk

The extension decrypts proxy credentials with a hardcoded AES key and can disable other installed browser extensions.

The extension fetches proxy configuration from vqols.cc and decrypts the returned credentials client-side using a hardcoded 256-bit AES key embedded in background.js. It also enumerates all installed browser extensions on every popup open and offers to disable any that hold proxy permissions, which may include legitimate security tools. Proxy authentication is triggered by making an HTTP request to api.telegra.ph with a randomised path suffix.

Free VPN Planetv1.0.13Chrome Web Store
49Risk
Who publishes it

FREE VPN PLANET SRL - 11 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Free VPN Planet
Declared legal entity
FREE VPN PLANET SRL
Registered address
Bulevardul Dimitrie Pompeiu 5, București, București 020335, RO
Registered contact
Planet VPN
Website
freevpnplanet.com/contact-us/

Same store account

11 other listings published from this account, 3.5M+ users between them. 2 of them carry a finding.

Planet Search2.0M+CleanFree VPN For Chrome & Ad blocker - Planet VPN1.0M+MediumVPN USA - Planet VPN lite Proxy200k+LowVPN India - Planet VPN lite Proxy100k+LowVPN Japan - Planet VPN lite Proxy50k+MediumVPN Turkey - Planet VPN lite Proxy30k+Clean5 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

vqols.cc
Also called by 3 other listings, including Free VPN USA - Planet VPN Proxy
cdn.freevpnplanet.com
Also called by 6 other listings, including Free VPN USA - Planet VPN Proxy, Dymo, Free VPN Proxy & Ad Blocker - Planet VPN

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup open reads installed proxy extensions

MediumunwantedCWE-200Dynamic sandbox

Opening the popup, its startup code reads your installed extensions via Chrome's management API, keeping entries that are enabled, have proxy permission, and aren't this extension, before you click anything.

What actually happens

You did this

You open the extension popup.

The extension did this

The popup immediately checks installed extensions and records enabled proxy-capable matches.

Extension metadata used by the conflict check

  • Installed extension type
    extension

    Shows whether another installed item is a browser extension rather than a theme or other component.

  • Enabled state
    true

    Shows whether another extension is currently active in your browser.

  • Proxy access
    proxy

    Shows whether another extension can affect proxy settings, which reveals part of your security or privacy setup.

  • Extension identifier
    bihmplhobchoageeokmgbdihknkjbknd

    Lets the extension distinguish one installed add-on from another and exclude its own ID from the conflict list.

The code that does this

Popup startup invokes the installed-extension conflict check

Readable version

Popup startup path

deobfuscated/popup.js
return Ln(async () => {  t.getConnectionStatusLS(), n.getServers(), n.getCurrentServer || n.getServers(), i.reviewModalStatus(_n.CHECK_MODAL_STATUS), s.checkConflictedExtensions(), r.checkConsentStatus(), a.getLocation();  const l = await o.checkingErrors(),    c = await o.checkingServersError();  l && i.openModal(st.RES_ERROR), c && i.openModal(st.SERVERS_ERROR)}), (l, c) => {

Conflict scan

deobfuscated/popup.js
async checkConflictedExtensions() {  qn.management.getAll(e => {    this.conflictedExtensions = e.filter(t => t.type === "extension" && t.enabled === !0 && t.permissions?.indexOf("proxy") !== -1 && t.id !== qn.runtime.id), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !0)  })}

What's stored on your device

When another enabled proxy-capable extension is present, the popup stores it as a conflict and can show that state in the interface.

Location
Popup conflict store state
Contents
{  "conflictedStatus": true,  "conflictedExtensions": [    {      "id": "bihmplhobchoageeokmgbdihknkjbknd",      "type": "extension",      "enabled": true,      "permissions": [        "proxy"      ]    }  ]}

Conflict prompt can disable other proxy extensions

MediumunwantedCWE-200Dynamic sandbox

Finding another enabled extension with proxy permission, the conflict prompt offers a button for Chrome users.

What actually happens

You did this

You click the conflict prompt after another proxy-capable extension has been listed.

The extension did this

The extension disables each listed extension by ID.

Criteria for extensions that can be disabled by this flow

  • Other extension ID
    bihmplhobchoageeokmgbdihknkjbknd

    Identifies the extension that can be turned off after the prompt button is clicked.

  • Enabled state
    true

    Only active extensions are added to the conflict list, so inactive extensions are skipped by this path.

  • Proxy permission
    proxy

    Shows that the extension can affect browser proxy settings, which may include VPN, privacy, or security add-ons.

The code that does this

Conflict modal button calls the disable routine

Readable version

Disable action

deobfuscated/popup.js
disableConflictedExtensions() {  this.conflictedExtensions.forEach(e => {    qn.management.setEnabled(e.id, !1)  }), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !1)}

Modal click handler

deobfuscated/popup.js
function n() {  Ps === We.FIREFOX ? t.howToDisableExtensions() : t.disableConflictedExtensions()}return (s, r) => (ie(), ue("div", q_, [r[0] || (r[0] = v("img", {  src: z_,  alt: "logo"}, null, -1)), v("h2", null, X(s.$t("modals.conflict.title")), 1), v("p", null, X(s.$t("modals.conflict.text-1")), 1), v("p", null, X(s.$t("modals.conflict.text-2")), 1), v("button", {  class: "btn btn--primary",  onClick: n}, X(T(Ps) === T(We).FIREFOX ? s.$t("modals.conflict.button-firefox") : s.$t("modals.conflict.button-chrome")), 1)]))

How each listed extension is handled

  1. On button click

    You did

    An enabled extension with proxy permission is present in the conflict list.

    The extension did

    The extension calls Chrome to set that extension to disabled.

Where it sends data

Destinations our analysis observed VPN United Kingdom - Planet VPN lite Proxy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • vqols.cc

    VPN United Kingdom - Planet VPN lite Proxy sends data to vqols.cc. 6 other extensions we have analyzed send data here.

  • api.telegra.ph

    VPN United Kingdom - Planet VPN lite Proxy sends data to api.telegra.ph. 5 other extensions we have analyzed send data here.

Updated 2 November 2026iibgamnboldgknjoighigjajflgcmfeh