Is Hola VPN - Your Website Unblocker safe?
We analyzed Hola VPN - Your Website Unblocker version 1.259.785's actual code and gave it a 57/100 trust score. This is a powerful, purpose-aligned VPN…
Bottom line
This is a powerful, purpose-aligned VPN with significant browsing-data collection and vendor control.
What it can access
It can route traffic across all websites and access browsing activity, while tracking domains and active time beyond basic VPN operation.[Q1][Q12][Q18]
Security weaknesses
Remote settings can change routing and data collection, while approved Hola pages can request privileged VPN actions.[Q16][Q21][Q22]
Signs of misuse
The package sends browsing domains, activity time, persistent IDs, and diagnostics to Hola, but shows no evidence of password or form theft.[Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests proxy, webRequest, tabs, webNavigation, cookies, scripting, storage and all-site host access. This scope is powerful but substantially aligned with a browser VPN.
Declares all-site host access plus proxy, request, tab, navigation, cookie and scripting permissions. — manifest.json:61-85
Makes two packaged Hola pages web-accessible on all sites. — manifest.json:89-98
Which websites can it run on, and can it read or change what appears on those pages?
It sees tab and request URLs and can inject fixed functions into proxied pages. I found no general-purpose code that copies arbitrary page text or form contents.
Tab and webRequest handlers process navigation and request URLs for proxy routing. — js/bg.bg.bundle.js:1
execute_in_page_context injects fixed timezone, geolocation and storage-adjustment functions under active rules. — js/bg.bg.bundle.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only declared content script is limited to Hola-controlled and internal pseudo-origins. — manifest.json:12-50
The content script forwards structured Hola page messages and does not read page forms or text. — js/bext/vpn/bg/cs_hola.js:42-64
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It accesses tabs, navigation events and cookies. Actual cookie reads are primarily for Hola identity/account state, with a remotely gated Google metadata experiment.
Declares tabs, webNavigation and cookies. — manifest.json:76-85
get_hola_cookies iterates Hola domains for named service cookies. — js/bg.bg.bundle.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
The permission lists do not include clipboard, downloads, camera or microphone capabilities. — manifest.json:73-85
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends Hola operational and browsing telemetry. Confirmed data include persistent identifiers, proxied site domains, active time and diagnostic data; error reports can include a request URL.
perr_send posts JSON telemetry to https://perr.hola.org/client_cgi/perr. — js/bg.bg.bundle.js:1
total_active_report submits root_url, country and active time; proxied_hosts can POST domain/host maps when remotely enabled. — js/bg.bg.bundle.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads JSON configuration from Hola every two hours. That configuration controls routing features, telemetry switches, site adjustments, experiments and notices, but it is treated as data rather than JavaScript.
request_bext_config fetches bext_config.json from Hola CDN or client endpoints and applies it. — js/bg.bg.bundle.js:1
Packaged defaults identify Hola client, CDN and telemetry endpoints plus proxy-agent hosts. — js/bg.conf.bundle.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The service worker starts automatically, fetches configuration, watches navigation and maintains proxy rules. Browsing telemetry can be emitted without a fresh click once the extension is enabled.
Registers bg.bg.bundle.js as the service worker. — manifest.json:9-11
Initialization attaches tab, navigation, request and proxy listeners and starts periodic config/telemetry tasks. — js/bg.bg.bundle.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It installs and clears PAC proxy settings. This is the core advertised VPN function and occurs only while active proxy rules require it.
Declares the proxy permission. — manifest.json:76-85
set_pac applies a generated PAC script through chrome.proxy.settings.set. — js/bg.bg.bundle.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Webpack bundle preserves descriptive module paths and symbol names. — js/bg.bg.bundle.js:1
Only the Hola service worker and Hola-domain content script are declared as active entry points. — manifest.json:9-50
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Lottie constructs an animation expression function with eval from animation data. — js/vendors.bundle.js:1
All observed Lottie components reference packaged relative JSON files. — js/620.bundle.js:1
Other new Function uses are serialization helpers and Webpack's fixed global-object fallback. — js/bg.bg.bundle.js:1
Does it track the websites, pages, searches, or links you visit?
It tracks root domains and active time for proxied tabs and samples roughly 2% of non-proxied tab activity. It does not automatically transmit the full continuous browsing history shown by the reviewed path.
total_active_report sends root_url and total_active_time for proxied tabs and samples non-proxied tabs with Math.random()*50. — js/bg.bg.bundle.js:1
Navigation event logging retains full URLs only when events_enabled is true; it is false by default. — js/bg.bg.bundle.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
A generated persistent UUID and account identifiers accompany Hola requests and telemetry. The extension's built-in privacy screen discloses log data including visited pages and time spent.
ensure_uuid creates and persists a long-lived UUID used in API and telemetry requests. — js/bg.bg.bundle.js:1
The packaged privacy text says log data can include web pages visited, time spent, access times and dates. — js/620.bundle.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads Hola cookies and service session state to authenticate the VPN. This is access to the service the user is using, not demonstrated credential theft.
get_hola_cookies reads named cookies only across Hola domains for installation/account state. — js/bg.bg.bundle.js:1
Chrome_headers conditionally reads the UULE cookie but transmits only its prefix/type and length. — js/bg.bg.bundle.js:1
The packaged AB-test configuration has test_send_chrome_headers off for the full range. — js/bg.bg.bundle.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The active content script handles Hola IPC messages, not keyboard, input or screenshot events. — js/bext/vpn/bg/cs_hola.js:42-64
Can a website or remote server send commands that make the extension take actions?
Hola's server controls proxy configuration, available agents, feature switches and site-specific adjustments. HTTPS and named Hola services constrain the source, but compromise of that vendor control plane could redirect traffic or alter supported sites.
Remote bext_config is stored and used by proxy, telemetry and site-configuration code. — js/bg.bg.bundle.js:1
Defines Hola control endpoints and proxy-agent infrastructure. — js/bg.conf.bundle.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
tz_spoof_fn, geo_spoof_fn and storage_spoof_fn execute in the page's main world only when a matching active rule and site config exist. — js/bg.bg.bundle.js:1
Packaged site configuration includes targeted storage changes for specific services. — js/bg.bg.bundle.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It intercepts request metadata and routes matching traffic through Hola proxy agents using a generated PAC script. This is necessary for the advertised VPN but grants the vendor substantial network control.
WebRequest handlers select rules, proxy agents and authentication for matching requests. — js/bg.bg.bundle.js:1
FindProxyForURL selects DIRECT or configured Hola proxy routes. — js/bg.bg.bundle.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
The permission lists do not include nativeMessaging. — manifest.json:73-85
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Extension pages use the default self-only script policy; connect-src is broad but does not permit remote scripts. — manifest.json:52-54
Remote bext_config is parsed and applied as structured data. — js/bg.bg.bundle.js:1
Lottie inputs observed in the active UI are packaged relative files. — js/620.bundle.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Scripts on a broad list of Hola-controlled domains can request privileged VPN actions, including enabling the extension and changing routing rules. Both the manifest match list and background origin check restrict the bridge to Hola domains.
Injects cs_hola.js only on enumerated Hola-controlled domains and internal pseudo-origins. — manifest.json:12-50
Accepts same-origin page messages marked src=hola_ccgi and forwards them to the extension. — js/bext/vpn/bg/cs_hola.js:42-64
ccgi_ipc_handler verifies sender.origin is a Hola URL before allowing commands such as set_rule and enable_root_url. — js/bg.bg.bundle.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior depends on remote Hola configuration, account/trial state, selected countries and user-enabled VPN rules. Remote settings can expand telemetry or page-adjustment behavior without replacing packaged JavaScript.
bext_config is refreshed periodically and drives collect_proxied_hosts, site rules, experiments and feature flags. — js/bg.bg.bundle.js:1
Proxy and page-adjustment paths require active rules and matching site configuration. — js/bg.bg.bundle.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Large bundle implements VPN routing, telemetry and UI support; no mining primitive or pool protocol was identified. — js/bg.bg.bundle.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The only active page content script forwards vendor IPC and does not inspect or modify forms. — js/bext/vpn/bg/cs_hola.js:42-64
Injected page functions are limited to timezone, geolocation and selected storage keys. — js/bg.bg.bundle.js:1