737 Chrome VPN Extensions Found Funneling Traffic Through Proxy Servers, Users Urged to Check

Security researchers have flagged a concerning batch of add-ons for Google Chrome: 737 VPN (virtual private network) extensions, the small programs that promise to create a private, encrypted tunnel for your browsing, are instead routing traffic through proxy servers. A proxy is a go-between computer that relays your internet requests, and when a VPN extension quietly sends your data through a proxy that you did not choose, the operator of that proxy may be able to see or even alter what you do online. The findings, reported in August 2026, are a reminder that not every tool in the Chrome Web Store, Google's official add-on marketplace, behaves the way its description claims.

For anyone who manages a website or works in an IT team, the risk is not abstract. If an employee or site administrator has one of these extensions installed in Chrome, every login, every admin page, and every piece of customer data they access through the browser could pass through an unexpected middleman. Even if the proxy is not deliberately stealing information, it introduces an extra point of failure and a potential privacy leak. A VPN extension should encrypt your traffic and send it directly to the VPN provider's server; routing it through a proxy instead breaks that trust model.

The core problem is transparency. Users install a VPN extension to hide their internet activity from their internet service provider or from snoops on public Wi-Fi. A virtual private network, or VPN, normally creates a secure tunnel between your device and the VPN company's server. But if the extension also pushes your traffic through a separate proxy, you have two different companies involved, and you may not have agreed to the second one. That second hop can log the websites you visit, inject ads, or even steal session cookies, the small files that keep you logged in to sites.

Chrome users can check their own browser in less than a minute. Open the extensions menu, usually a puzzle-piece icon in the top right, choose Manage extensions, and look for any VPN or proxy-related add-on you do not remember installing. The 737 extensions identified in the report are not named in the public summary, so the safest approach is to remove any VPN extension you cannot verify with certainty. After removal, change passwords for important accounts, especially if you used the extension while logging into a website, an email account, or a hosting control panel.

For website owners and businesses, this incident highlights why endpoint security matters. A single browser extension can bypass firewalls, secure DNS settings, and even multi-factor authentication (a security step that requires a second proof of identity beyond a password) in some cases, because it operates inside the trusted browser session. IT teams should review which extensions are allowed on company devices and consider blocking all but an approved list. Regular audits of browser extensions are as important as patching servers, because the browser is now a primary work tool.

At AEU Group, we often see breaches that start with a small, overlooked component, and browser extensions are a classic example. Organizations that want to reduce this risk can use AEU-I, our security-first IT and consulting service, to audit endpoint configurations, enforce browser extension policies, and train staff to recognize untrustworthy add-ons. Combined with good password hygiene and keeping Chrome updated, these steps give you a practical defense against this type of silent traffic redirection.