Is Browsec VPN - Free VPN for Chrome safe?
We analyzed Browsec VPN - Free VPN for Chrome version 3.93.8's actual code and gave it a 44/100 trust score. This is a functional VPN with unusually broad…
Bottom line
This is a functional VPN with unusually broad access, persistent tracking, promotional behavior, and remotely controlled network activity.
What it can access
It can route and observe traffic across all websites, alter pages, clear site data, and optionally change privacy settings or disable other extensions; this exceeds a narrowly scoped VPN. [Q1]
Security weaknesses
Remote settings can choose network-check destinations and cause requests to potentially private or local addresses without a clear origin restriction. [Q16][Q19]
Signs of misuse
It sends persistent usage data and selected visited domains to its services, while injecting promotional offers and attaching tracking details to purchase links. [Q6][Q12][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests proxy control, all-site host access, web-request observation, scripting, browsing-data removal and optional privacy, tabs and extension-management access. Proxy and request access are expected for a VPN; the remaining reach materially expands its power.
Declares proxy, webRequest, webRequestAuthProvider, scripting, browsingData and <all_urls>, plus optional privacy, tabs and management permissions. — manifest.json:1-35
Installs PAC proxy settings, observes all-site request completion/errors and can request optional WebRTC privacy and extension-management access. — background.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It runs page access at document start on every HTTP/HTTPS page, receives each page's URL for timezone decisions, and injects Browsec promotional UI on selected streaming and adult sites.
browsecSiteContentScript.js runs on all HTTPS pages and timezoneChange.js runs on all HTTP and HTTPS pages at document_start. — manifest.json:12-27
Sends location.href to the worker and injects code that replaces page-world Date behavior when timezone masking is enabled. — timezoneChange.js:1
On supported sites, builds and inserts Browsec Premium banner markup and reports show/click messages with the current URL. — notification.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The page bridge accepts only structured auth messages and forwards them for signature verification; it does not query input fields. — browsecSiteContentScript.js:1
Only requests timezone offsets and replaces Date methods. — timezoneChange.js:1
Builds its own banner elements and does not read host-page form controls. — notification.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
As a proxy, it can observe browsing destinations and supplies the user's Browsec email/access token for proxy authentication. It does not request Chrome's cookies or history services, but can remove cache and service-worker data for a site after a tunnel failure.
onAuthRequired returns the stored email and access_token only for recognized Browsec proxy hosts and realm. — background.js:1
All-site webRequest listeners derive request domains, count proxied navigation/traffic, and may clear cache, appcache, Cache Storage and service workers for the failed origin. — background.js:1
Declares proxy, webRequest and browsingData but not cookies or history. — manifest.json:7-35
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can modify Chrome's WebRTC IP-handling policy after optional privacy permission and can enumerate/disable other proxy extensions after optional management permission. It does not access camera, microphone, location, clipboard or arbitrary local files.
WebRTC protection sets privacy.network.webRTCIPHandlingPolicy to disable_non_proxied_udp or proxy_only. — background.js:1
Requests management permission, lists enabled extensions with proxy permission and can disable selected entries. — pages/unblock_proxy/unblock_proxy.js:287
No geolocation, clipboard, camera, microphone, downloads or file-system permission is declared. — manifest.json:7-35
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends a persistent client ID, install/version, premium and experiment state plus usage, connection, traffic and promotion events to Google Analytics and Browsec-selected metrics domains. Selected visited domains are included when its in-page promotion is shown or clicked.
buildPayload adds cid, experiments, premium state, app/install version, installation timestamp, event timestamp and platform to Jitsu event requests. — background.js:1
Creates or loads gaRareUserId, synchronizes it with Browsec's account API, and sends GA4/Jitsu events to configured metrics endpoints. — background.js:1
inpage_notification show/click events include inpage_notification_domain derived from the page URL. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads remote JSON that can replace proxy servers, metrics hosts, promotions, experiments, connection checks and background network-test groups. No downloaded JavaScript is executed.
Fetches root server data from a fixed GitHub Gist and periodically fetches dynamic configuration from a Gist or fallback mirrors. — background.js:1
updateDynamicConfig stores object-valued remote configuration and listeners apply browcheckEnabled, browcheckGroups, connectionCheck and metrics settings. — background.js:1
Remote promotions and experiment state alter displayed offers and behavior without an extension update. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It performs background telemetry, remote updates and network checks automatically, and can inject a Browsec Premium banner while the user visits supported sites. Timezone masking changes page behavior automatically when enabled.
Startup and alarms schedule remote configuration updates, user-location checks, retention events and browcheck network tests. — background.js:1
The banner is prepared and displayed in-page based on proxy, promotion and visibility state rather than a click on that page. — notification.js:1
Runs at document_start and modifies Date automatically when the stored feature is enabled for the proxied site. — timezoneChange.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It controls Chrome's regular proxy configuration and can optionally change the WebRTC IP-handling policy. Those changes serve the advertised VPN function, but they affect all browser networking.
Builds and installs PAC data through chrome.proxy.settings and clears the proxy on worker suspension. — background.js:1
Optional WebRTC protection changes privacy.network.webRTCIPHandlingPolicy. — background.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most logic is compiled into large minified Webpack bundles, and the package contains extensive third-party libraries and many generated proxy domains. The major behaviors, services and event data remain traceable; deliberate string concealment was not found.
Approximately 1.67 MB minified Webpack service worker combines application logic, browser shims, lodash, crypto and telemetry modules. — background.js:1
The CSP contains a very large generated list of HTTP proxy/connectivity host families. — manifest.json:1-35
Package inventory records the compiled scripts and bundled assets reviewed. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The only new Function occurrence is Webpack runtime code that returns the global object; no eval( occurrence exists in the active top-level scripts. — background.js:1
Extension-page script-src permits only self and does not include unsafe-eval. — manifest.json:1-35
Does it track the websites, pages, searches, or links you visit?
It observes all-site navigation/request metadata for proxy operation and reports usage events. Most general browsing events omit the destination, but promotion analytics explicitly transmit the visited domain for selected streaming and adult sites.
All-site request-completion listeners derive domains, count proxied pages and traffic, and emit connection/retention events. — background.js:1
Promotion show/click handlers derive the domain from the content-script URL and send it as inpage_notification_domain and an analytics label. — background.js:1
Runs only on a fixed list including YouTube, BBC, Spotify, Twitch and numerous adult sites, and sends the current location.href with show/click messages. — notification.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates or retrieves a stable gaRareUserId, stores it locally, synchronizes it to the user's Browsec account and includes it as cid in analytics and promotional links.
Loads extintid from Browsec, generates an RFC4122-style ID when absent, stores gaRareUserId and posts it back to the account attribute API. — background.js:1
buildPayload and promotional URL generation include the persistent ID as cid. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It transmits Browsec account authentication data to recognized proxy servers and attaches encoded account credentials as Authorization headers across a large fixed list of Browsec, CDN, payment and mirror domains. It does not read arbitrary website cookies or form credentials.
onAuthRequired supplies email and access_token only for recognized Browsec proxy hosts, proxy challenges and realm Browsec. — background.js:1
The authorization-header path maps siteAuthorizationDomains across dozens of Browsec, CDN, payment, static and mirror domains and adds encoded login credentials outside /api/ and /assets/ paths. — background.js:1
No cookies permission is declared. — manifest.json:7-35
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Event listeners are attached to extension-created close and promotional-link elements, not host-page inputs. — notification.js:1
No clipboard, desktopCapture or tabCapture permission is declared. — manifest.json:7-35
Can a website or remote server send commands that make the extension take actions?
Browsec's servers can command meaningful behavior through configuration: choose proxy infrastructure and telemetry hosts, provide promotions and experiments, change the connection-check URL/method, and schedule groups of arbitrary network-test URLs.
browcheckGroups from dynamicConfig are scheduled as alarms; each item controls URL, timeout, interval and sampling, and the result is reported. — background.js:1
connectionCheck can remotely override its URL, method and timeout, while root/dynamic configuration updates proxy servers, metrics and promotions. — background.js:1
The extension temporarily bypasses the VPN for a browcheck target's domain before fetching the server-supplied URL. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It injects Browsec Premium promotions into a fixed list of sites and adds campaign, referrer, installation-age, experiment, client-ID and current-site attribution to purchase links. It does not replace search results or inject third-party advertising.
Builds Browsec-branded in-page upgrade banners and promotional links on supported sites. — notification.js:1
Promotion URLs receive cid, instd, ref, campaign, expvarid and utm_content based on the current site's second-level domain. — background.js:1
Browsec promotion pages receive matching account/campaign query parameters and click telemetry. — promoPageExecutor.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
Traffic interception and modification are core features: it installs a PAC proxy, handles proxy authentication, watches all request completion/errors, adds Browsec headers on service domains and counts proxied response bytes.
Installs PAC rules, handles onAuthRequired, observes all-site response headers and tunnel errors, and records aggregate traffic in 10 MB steps. — background.js:1
Sets X-Browsec-Installed: 1 on Browsec main-frame, sub-frame and XMLHttpRequest traffic. — rules.json:1
A second header path for non-MV3 builds adds X-Browsec-Installed and encoded Authorization headers to the configured service domains. — background.js:1
Can it communicate with software on the computer or services running on localhost?
Its all-URL proxy and remotely configurable network checks can reach localhost or private-network URLs if such a target is supplied, although no native-messaging capability or fixed localhost target was found.
<all_urls> host access and the proxy cover local HTTP/HTTPS destinations; nativeMessaging is absent. — manifest.json:7-35
browcheck accepts item.url from remote dynamic configuration without an origin allowlist before fetching it. — background.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Root and dynamic responses are parsed/stored as data used by explicit proxy, metrics, promotion and network-check code paths. — background.js:1
Injects a local fixed Date shim after substituting numeric original/proxy offsets; no remote string becomes code. — timezoneChange.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Every HTTPS page can post a structured auth event to the page access, but the worker accepts account state only after verifying the event's embedded signature and environment. No web-accessible privileged files are declared.
A document-start window message listener on every HTTPS page forwards type=auth messages with credential/guest shape to the worker. — browsecSiteContentScript.js:1
The auth handler requires HTTPS, the production environment, a valid account shape and successful RSA signature verification before changing user state. — background.js:1
No web_accessible_resources or externally_connectable entry is present. — manifest.json:1-35
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The extension selectively activates in-page promotions only on a fixed set of media and adult domains and reports those domains on display/click. Remote experiment and sampling values also gate behavior.
The notification-site list includes BBC, YouTube, Spotify, Twitch, Vimeo and numerous adult-video sites; content is injected only when a tab URL matches. — background.js:1
Promotion/experiment selection and browcheck sampling determine which users receive UI or network checks. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Scheduled alarms cover configuration, location, health-check and telemetry operations; no mining protocol, wallet or hash loop appears. — background.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates its own div/a/span/img promotion tree and does not select or mutate existing forms. — notification.js:1
Only replaces Date constructor/prototype methods. — timezoneChange.js:1
Only relays a narrowly shaped signed account message and does not inspect or alter forms. — browsecSiteContentScript.js:1