Loading story…
Investigations found that several popular Chrome and Edge extensions collected sensitive user data at scale, including AI chat conversations and browsing activity, often with limited transparency. Reports said extensions such as Urban VPN, Stylish, Poper Blocker, SimilarWeb, StayFocusd, CrxMouse, WhatRuns, and StayFree had either directly exfiltrated AI chat content or retained the remote-configurable capability to do so, affecting more than 7 million installs combined; a separate report alleged Urban VPN-related "privacy" extensions monetized data from roughly 8 million users. Researchers also reported that Urban VPN had previously scraped AI conversations and that its user-facing opt-out of data collection control was inverted in code, potentially leaving collection enabled even when users believed they had disabled it.
Urban VPN was also found to contain a high-severity browser-extension flaw that let any website send privileged postMessage commands without origin validation, allowing attackers to disconnect the VPN, reroute traffic, change bypass settings, disable privacy protections, disable competing extensions, and query extension state. The issue was reportedly fixed in Urban VPN version 5.12.5 by limiting accepted messages to a read-only query, while broader concerns about data collection practices remained. Together, the findings raised concerns that widely installed browser extensions marketed around convenience or privacy could both harvest sensitive content and expose users to direct manipulation of browser security controls.
Trace attribution and downstream blast radius.
15 events from the most recent confirmed update back to the earliest known activity.
Signer.Digital released extension version 5.2.0 and native host version 6.0.0.0 to fix the drive-by RCE vulnerability. The native host update was the effective remediation, while the extension patch alone did not fully mitigate the issue.
Urban VPN told the researchers that the update had been completed on 23 March 2026. This statement conflicted with the later-noted Chrome Web Store publication date for version 5.12.5.
Signer.Digital later confirmed it could reproduce the reported remote code execution vulnerability. This validated the researchers' findings during coordinated disclosure.
Urban VPN published version 5.12.5 to the Chrome Web Store, restricting the vulnerable message interface to a single read-only query and blocking the prior control commands. The patch addressed the postMessage command-injection issue.
Researchers reported the Signer.Digital issue to CERT-In because of the extension's use in banking and healthcare contexts. The escalation reflected concern over the product's broad deployment in India.
Signer.Digital acknowledged receipt of the researchers' vulnerability report. This was the vendor's first documented response in the coordinated disclosure timeline.
Researchers reported a drive-by remote code execution vulnerability in Signer.Digital's browser extension and native host to the vendor, including a proof of concept and video demonstration. The issue allowed arbitrary websites to trigger code execution on affected Windows systems.
WhatRuns stopped collecting AI chats in version 1.10.0. The change was identified in later research on browser extensions scraping AI chats and URLs.
Urban VPN told the researchers that fixes for the reported postMessage vulnerability would be released soon. This marked a vendor status update during the disclosure process.
Researchers formally reported the Urban VPN postMessage command-injection vulnerability with a proof of concept. Urban VPN acknowledged the report the same day.
Researchers began initial outreach to Urban VPN regarding the extension's postMessage issue. The flaw allowed any website to send privileged commands to the extension without origin verification.
Koi Security reported that Urban VPN appeared to capture user conversations with ChatGPT, Gemini, and Claude. Later reporting cited this as prior December 2025 exposure of Urban VPN's AI-chat scraping behavior.
Public reporting said Signer.Digital's auto-update mechanism appeared broken because the update feed advertised version 3.3.0.0, preventing existing 5.x native hosts from automatically updating to the fixed 6.0.0.0 release. As a result, manual reinstallation of the host was required for many users.
Researchers reported that several popular Chrome extensions with more than 7 million combined installs scraped AI chats, browsing URLs, or both, with some behavior controlled remotely after installation. The report named Stylish, Poper Blocker, SimilarWeb, StayFocusd, CrxMouse, WhatRuns, StayFree, and noted UrbanVPN had historically scraped AI chats but no longer did so at the time of testing.
Public reporting described how any website could control Urban VPN through postMessage using the public extension ID and hardcoded sender string "Toad," enabling actions such as disconnecting the VPN, rerouting traffic, changing bypass settings, and disabling protections. The report also said the extension's data-collection opt-out logic was inverted and broader data-collection behavior remained unchanged after the patch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
amibeingpwned.com
Open sourceamibeingpwned.com
Open sourceamibeingpwned.com
Open sourcekoi.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Urban VPN Proxy Chrome extension, boasting over 6 million installs and a "Featured" badge on the Chrome Web Store, was discovered secretly collecting and exfiltrating user conversations with major AI chatbots, including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI. Researchers found that a silent update in July 2025 (version 5.5.0) introduced hidden code that intercepts every prompt and response exchanged with these AI platforms, along with conversation identifiers, timestamps, and session metadata. The extension, which markets itself as a privacy and security tool, continued to harvest data regardless of whether the VPN service was active, betraying user trust and bypassing normal browser security boundaries. Captured data was sent to Urban VPN’s servers and subsequently sold to marketing analytics firms, notably BiScience, a known data broker. The malicious behavior was enabled by script injection that overrode browser APIs such as `fetch()` and `XMLHttpRequest()`, ensuring all relevant traffic was intercepted. The extension’s widespread distribution and high user ratings, combined with its presence on both Chrome and Edge marketplaces, amplified the impact of this breach. The incident highlights the risks posed by browser extensions with privileged access and the potential for abuse even among highly rated and officially endorsed add-ons.
Jun 29, 2026
Urban VPN Proxy, a popular browser extension marketed as a free clientless VPN for Chrome, has been found to secretly collect and sell user conversations from major AI chatbot platforms to third-party data brokers. Security researchers at Koi Security revealed that since July, the extension has harvested every prompt and response from platforms including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI, impacting approximately 8 million users. The data collection occurs regardless of whether the VPN feature is enabled, and users have no option to disable this surveillance except by uninstalling the extension. Additional extensions from the same publisher, such as 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker, also engage in similar data harvesting activities, despite carrying "Featured" badges in browser app stores, which typically indicate a level of trust and manual review. The exposure of this privacy violation highlights significant risks associated with browser extensions, especially those that interact with sensitive AI platforms. The incident underscores the need for stricter vetting of browser extensions and greater transparency regarding data collection practices. Users and organizations relying on browser-based AI tools should review installed extensions for potential privacy risks and consider removing those with questionable data handling practices, even if they appear reputable or highly rated in official app stores.
Jun 29, 2026
Researchers reported that several AI-themed browser extensions in official marketplaces covertly harvested user conversations from generative AI services including **ChatGPT, Claude, Copilot, Gemini, and DeepSeek**. G Data identified **Urban VPN**, **Smart Sidebar: ChatGPT, Claude and DeepSeek**, and **AI Assistant/Chat AI** as examples that remained outwardly functional while injecting scripts, intercepting requests, tampering with page content, or using hidden iframes to capture prompts and responses from visited AI sites. Investigators said the stolen data included conversation IDs, hostnames, timestamps, and full chat histories, with some payloads encoded in Base64 and sent to external servers. The extensions reportedly had strong ratings, large user bases, and in one case a Chrome Web Store **Featured** badge, underscoring how official store vetting can miss dynamic malicious behavior such as remote iframe communications; researchers warned that AI-focused extensions now expose a broad attack surface and urged enterprises to enforce strict extension allow-listing, minimize permissions, and remove unnecessary add-ons from systems accessing sensitive AI platforms.
Jun 29, 2026