Is Green VPN - Free VPN Proxy, Fast & Secure safe?
We analyzed Green VPN - Free VPN Proxy, Fast & Secure version 2.1.9's actual code and gave it a 58/100 trust score. This is a powerful VPN extension with…
Bottom line
This is a powerful VPN extension with broad browser access and meaningful privacy concerns, but the evidence does not establish deliberate theft or arbitrary code execution.
What it can access
It can operate across all websites, inspect request data while connected, control the global proxy, and manage other extensions.[Q2][Q3][Q5][Q9][Q18] These powers fit a VPN’s routing purpose, but are broader and more sensitive than a typical page feature.[Q14]
Signs of misuse
The extension sends persistent installation and usage information to its service and lets remote settings influence routing, credentials, and disconnection.[Q6][Q13][Q16] This is privacy-sensitive and creates remote control over VPN behavior, but the evidence does not establish arbitrary code, visit
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests broad access to websites, browser traffic, proxy settings, and installed extensions; this supports a VPN, but gives it substantial power over browsing and network routing.
The extension requests proxy, webRequest, webRequestAuthProvider, scripting, tabs, management, storage, alarms, and notifications permissions, plus access to <all_urls>. — manifest.json:1
When connected, it applies a server-selected global proxy configuration. — background.js:138-166
While connected, it can inspect raw request-body byte data to measure traffic volume. — background.js:234-241
It sends aggregate traffic measurements to its service. — background.js:219-224
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
While connected, the extension reads raw request-body bytes through webRequest to estimate upload volume, so it can observe data submitted in forms, including sensitive fields. The code sends only byte totals to its server, not the recovered field contents.
The extension has webRequest and all-URL host permissions. — manifest.json:5-8
The onBeforeRequest listener receives requestBody data and reads raw byte lengths from each body segment. — background.js:234-241
Only aggregate rx and tx byte counts are sent to the telemetry endpoint. — background.js:219-224
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code was found that reads website cookies, browsing history, bookmarks, downloads, or signed-in sessions. It does receive proxy credentials and an extension installation identifier, which are separate from website session data.
No cookies, history, bookmarks, or downloads permissions are declared. — manifest.json:5-8
The code obtains and caches proxy authentication credentials from its own service. — background.js:37-82
The persistent identifier is generated for the extension and used for its uninstall callback. — background.js:84-105
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: management.
The manifest requests: management — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends a persistent installation ID, connection state, selected location, timing, estimated traffic volume, Pro state, and redemption data to green-vpn.app. It also sends proxy-related requests there to obtain server lists and credentials.
The service worker sends the installation ID to the server and consumes returned proxy credentials, server data, and Pro state. — background.js:49-74
Heartbeat requests send installation ID, selected location, and on/off state. — background.js:107-123
Connection events, duration, and aggregate byte totals are sent to the telemetry endpoint. — background.js:209-224
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads server-supplied settings and instructions such as proxy locations, credentials, minimum-version rules, Pro state, update links, and popup content. The reviewed package does not download and execute arbitrary JavaScript code.
Server responses supply credentials, proxy host data, minimum version, and location fields used by proxy configuration. — background.js:49-74,138-166
The service worker repeatedly polls the server for Pro-state changes. — background.js:376-398
Server responses control popup metadata, location rendering, update gating, and HTML content. — popup.js:51-73,119-127,258-279,661-723
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It makes network requests automatically for credential refresh, heartbeats, telemetry, Pro polling, and uninstall notification, and it reapplies proxy or kill-switch state at startup. Changing the proxy and disabling competing proxy extensions require the user's Connect action.
Startup, alarms, telemetry, and the long-poll loop generate requests without a per-request user prompt. — background.js:105-123,242-249,376-398
The service worker changes global proxy settings on connection, disconnect, kill-switch state, and startup restoration. — background.js:166,178-205,292-298
The Connect handler disables other enabled proxy extensions before sending the connect request. — popup.js:600-637
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It can change browser settings or manage installed extensions through: management, proxy.
The manifest requests setting-related permissions: management, proxy — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The extension's shipped JavaScript is readable and its important runtime entry points are present in the package. It uses simple XOR obfuscation for proxy credentials and consumes remote settings, but neither makes the local implementation substantially hidden or dynamically generated.
The credential transformation is a visible base64 decode followed by XOR with a shipped key. — background.js:37-47
Remote responses are handled by ordinary visible fetch, parsing, and proxy-setting code. — background.js:49-74,138-166
Server-controlled UI and location data are processed in inspectable popup code. — popup.js:51-73,661-723
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence was found of eval(), new Function(), or string-based timers being used to execute text as code.
The reviewed background service-worker code uses ordinary functions and APIs rather than text-to-code execution. — background.js:1-398
The reviewed popup code uses ordinary DOM and network operations; no text-based code execution was identified. — popup.js:1-760
Does it track the websites, pages, searches, or links you visit?
The extension records connection use, selected VPN location, timing, liveness, and aggregate upload/download estimates, but the reviewed code does not store, correlate, or transmit visited URLs, searches, or link destinations. It therefore does not establish website-visit tracking.
Telemetry contains installation ID, location, state, duration, and aggregate byte counts. — background.js:107-123,209-224
WebRequest listeners inspect response Content-Length and request-body sizes, not request URLs for telemetry or page identity. — background.js:225-241
Does it create a persistent ID or browser fingerprint to recognize you?
On first use, the extension creates a random installation identifier, stores it persistently, and sends it with server requests. It also places the same identifier in the uninstall callback URL; no browser fingerprint collection was found.
getIid creates and stores a random identifier, and setUninstallHook embeds it in the uninstall URL. — background.js:84-105
The identifier is included in liveness, telemetry, and control-plane requests. — background.js:107-112,209-216,382-390
Does it send cookies, session details, authentication data, or page contents elsewhere?
When connected, the extension routes browser traffic through a server-selected HTTP or HTTPS proxy, so the relay receives the network traffic that Chrome sends through it. The extension does not copy cookies, passwords, sessions, or page contents into its own telemetry requests.
Server-provided relay fields are installed as Chrome's global proxy configuration. — background.js:138-166
Proxy authentication is answered for all URLs with runtime-loaded credentials. — background.js:125-134
Telemetry sends event and byte totals, not request headers, cookies, bodies, or response contents. — background.js:209-241
Does it record typing, form entries, clipboard contents, or screenshots?
No code evidence shows keylogging, form-entry recording, clipboard reading, or screenshots. Clipboard use is limited to copying an extension-provided Pro code.
Uses the clipboard API to copy the displayed shareable Pro code. — popup.js:332-355
Can a website or remote server send commands that make the extension take actions?
Remote responses can make the extension change routing and authentication behavior, force an outdated build to disconnect, and update UI or Pro state. The server does not appear to send arbitrary commands, but it controls several privileged actions through parsed settings.
Server responses set proxy host data, credentials, minimum-version state, and disconnect behavior. — background.js:49-74,138-166
The service worker continuously polls the remote control plane and stores returned Pro state. — background.js:376-398
Server data controls available locations, UI, update gating, and connection-related state. — popup.js:51-73,661-723
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence shows link, referral-code, advertisement, shopping-cart, or search-result manipulation. The extension changes network routing instead of rewriting page links or page results.
Configures proxy routing but does not alter URL contents or page search results. — background.js:138-166
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
When connected, the extension changes Chrome's regular global proxy settings to a server-selected HTTP or HTTPS relay and answers proxy authentication challenges. Its kill switch can instead route all traffic to a dead local proxy while disconnected.
connect builds fixed_servers settings from server/location fields and applies them at regular scope. — background.js:153-170
The onAuthRequired listener supplies runtime credentials for proxy challenges on all URLs. — background.js:125-134
The kill switch installs a dead proxy or restores system mode depending on state. — background.js:178-205,252-257
Can it communicate with software on the computer or services running on localhost?
No code evidence shows communication with native computer software or localhost services. Localhost is explicitly placed in the proxy bypass list, and the kill switch's localhost address is only a dead proxy endpoint.
Bypasses localhost and 127.0.0.1 in the normal proxy configuration. — background.js:153-166
Uses 127.0.0.1:1 as a traffic-blocking proxy, not as a contacted service. — background.js:178-181
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension decodes server-supplied obfuscated data into proxy credentials, but the decoded value is used as authentication data rather than executable code. It also contains a fixed page overlay injector, yet no active runtime caller to that injector was found.
Base64/XOR decoding produces username and password values that are cached and supplied to proxy authentication. — background.js:37-47,65-81
The page-injection functions contain fixed self-contained overlay code, but only function definitions are present in the reviewed runtime. — background.js:303-374
The active Pro polling loop updates state and explicitly notes that the in-page box is not shown. — background.js:376-400
Can ordinary websites access privileged extension features through messaging or exposed files?
No externally exposed webpage messaging handler or extension-accessible resource was found. The reviewed message handling is extension-internal, chiefly between the popup and background worker.
Popup sends internal runtime messages for connection actions. — popup.js:470-485,621-637
Background handles internal kill-switch state messages. — background.js:252-257
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior varies with remote settings and state: server responses control Pro status, available locations, credentials, minimum version, UI, and forced disconnection, while connection and kill-switch state change routing. These paths activate only after the relevant server response, stored state, or user action.
Remote credentials, proxy fields, minimum version, and Pro state affect runtime behavior. — background.js:49-74,138-166
Kill-switch and stored connection state determine whether traffic is routed or blocked, including at startup. — background.js:178-205,252-257,292-298
Remote UI, location, Pro, and update metadata change popup behavior. — popup.js:51-73,661-723
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of cryptocurrency mining or other concealed heavy computation. Background activity is mainly proxy management, telemetry, polling, and UI support.
Periodic work consists of liveness, heartbeat, request-size telemetry, and open events. — background.js:107-123,225-249
Does it change form fields or where a form sends its information?
No code evidence shows changing form fields or form destinations. The extension's observed web behavior is proxy configuration and optional page-overlay injection, not form manipulation.
The page-injection code creates an overlay and does not modify forms. — background.js:303-374
Traffic changes occur through proxy settings rather than rewriting form actions. — background.js:138-166