Is VPN United Kingdom - Planet VPN lite Proxy safe?

Medium risk

The extension decrypts proxy credentials with a hardcoded AES key and can disable other installed browser extensions.

The extension fetches proxy configuration from vqols.cc and decrypts the returned credentials client-side using a hardcoded 256-bit AES key embedded in background.js. It also enumerates all installed browser extensions on every popup open and offers to disable any that hold proxy permissions, which may include legitimate security tools. Proxy authentication is triggered by making an HTTP request to api.telegra.ph with a randomised path suffix.

Free VPN Planetv1.0.13Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Popup open reads installed proxy extensions

Opening the popup, its startup code reads your installed extensions via Chrome's management API, keeping entries that are enabled, have proxy permission, and aren't this extension, before you click anything.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the extension popup.

The extension did this

The popup immediately checks installed extensions and records enabled proxy-capable matches.

02EvidenceFIELD TABLE
Extension metadata used by the conflict check
FieldValueWhy it matters
Installed extension type
extensionShows whether another installed item is a browser extension rather than a theme or other component.
Enabled state
trueShows whether another extension is currently active in your browser.
Proxy access
proxyShows whether another extension can affect proxy settings, which reveals part of your security or privacy setup.
Extension identifier
bihmplhobchoageeokmgbdihknkjbkndLets the extension distinguish one installed add-on from another and exclude its own ID from the conflict list.
03EvidenceCODE COMPARE
The code that does this

Popup startup invokes the installed-extension conflict check

What it actually does
Popup startup pathdeobfuscated/popup.js
return Ln(async () => {
  t.getConnectionStatusLS(), n.getServers(), n.getCurrentServer || n.getServers(), i.reviewModalStatus(_n.CHECK_MODAL_STATUS), s.checkConflictedExtensions(), r.checkConsentStatus(), a.getLocation();
  const l = await o.checkingErrors(),
    c = await o.checkingServersError();
  l && i.openModal(st.RES_ERROR), c && i.openModal(st.SERVERS_ERROR)
}), (l, c) => {
Conflict scandeobfuscated/popup.js
async checkConflictedExtensions() {
  qn.management.getAll(e => {
    this.conflictedExtensions = e.filter(t => t.type === "extension" && t.enabled === !0 && t.permissions?.indexOf("proxy") !== -1 && t.id !== qn.runtime.id), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !0)
  })
}
04EvidenceSTORAGE DUMP
What's stored on your device

When another enabled proxy-capable extension is present, the popup stores it as a conflict and can show that state in the interface.

LocationPopup conflict store state
Contents (JSON)
{
  "conflictedStatus": true,
  "conflictedExtensions": [
    {
      "id": "bihmplhobchoageeokmgbdihknkjbknd",
      "type": "extension",
      "enabled": true,
      "permissions": [
        "proxy"
      ]
    }
  ]
}
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Conflict prompt can disable other proxy extensions

Finding another enabled extension with proxy permission, the conflict prompt offers a button for Chrome users.

Clicking it makes the popup iterate the stored conflict list and call Chrome's management API to disable each listed extension.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click the conflict prompt after another proxy-capable extension has been listed.

The extension did this

The extension disables each listed extension by ID.

02EvidenceFIELD TABLE
Criteria for extensions that can be disabled by this flow
FieldValueWhy it matters
Other extension ID
bihmplhobchoageeokmgbdihknkjbkndIdentifies the extension that can be turned off after the prompt button is clicked.
Enabled state
trueOnly active extensions are added to the conflict list, so inactive extensions are skipped by this path.
Proxy permission
proxyShows that the extension can affect browser proxy settings, which may include VPN, privacy, or security add-ons.
03EvidenceCODE COMPARE
The code that does this

Conflict modal button calls the disable routine

What it actually does
Disable actiondeobfuscated/popup.js
disableConflictedExtensions() {
  this.conflictedExtensions.forEach(e => {
    qn.management.setEnabled(e.id, !1)
  }), this.conflictedExtensions.length > 0 && (this.conflictedStatus = !1)
}
Modal click handlerdeobfuscated/popup.js
function n() {
  Ps === We.FIREFOX ? t.howToDisableExtensions() : t.disableConflictedExtensions()
}
return (s, r) => (ie(), ue("div", q_, [r[0] || (r[0] = v("img", {
  src: z_,
  alt: "logo"
}, null, -1)), v("h2", null, X(s.$t("modals.conflict.title")), 1), v("p", null, X(s.$t("modals.conflict.text-1")), 1), v("p", null, X(s.$t("modals.conflict.text-2")), 1), v("button", {
  class: "btn btn--primary",
  onClick: n
}, X(T(Ps) === T(We).FIREFOX ? s.$t("modals.conflict.button-firefox") : s.$t("modals.conflict.button-chrome")), 1)]))
04EvidenceCORRESPONDENCE
How each listed extension is handled
WhenYou didExtension did
On button click
extension
An enabled extension with proxy permission is present in the conflict list.
extension
The extension calls Chrome to set that extension to disabled.

Data recipients

vqols.ccapi.telegra.ph
Updated 17 September 2026iibgamnboldgknjoighigjajflgcmfeh