Source URL: https://www.theregister.com/2025/08/21/freevpn_privacy_research/
Source: The Register
Title: Google yet to take down ‘screenshot-grabbing’ Chrome VPN extension
Feedly Summary: Researcher claims extension didn’t start out by exfiltrating info… while dev says its actions are ‘compliant’
Security boffins at Koi Security have warned of a shift in behavior of a popular Chrome VPN extension, FreeVPN.One, which recently appears to have begun snaffling screenshots of users’ page activity and transmitting them to a remote server without their knowledge – and Google has yet to take it down.…
AI Summary and Description: Yes
Summary: The text discusses a concerning change in the behavior of the FreeVPN.One Chrome VPN extension, which has reportedly begun stealing users’ screenshots without consent. This raises significant privacy and security issues, particularly as the extension remains available despite these allegations.
Detailed Description: The passage highlights an important issue in information and privacy security, specifically regarding the behavior of Chrome VPN extensions. Here are the key points of concern:
– **Behavior Shift**: The FreeVPN.One extension has allegedly transitioned from its initial purpose to now exfiltrating sensitive data—screenshots of users’ activities—without their consent.
– **Compliance Claims**: The developers of the extension have reportedly stated that their actions are ‘compliant,’ suggesting a potential misunderstanding or misrepresentation of user consent and privacy norms.
– **Lack of Action from Google**: Despite these serious allegations, there has been no action from Google to remove the extension from their platform, which raises questions about the effectiveness of their review and monitoring processes.
Implications for Security and Compliance Professionals:
– **User Data Privacy**: The incident underscores the necessity for regular audits and monitoring of third-party applications and extensions that have access to user data.
– **Vendor Risk Management**: Organizations need to be diligent when implementing third-party tools, particularly in ensuring that those tools comply with privacy regulations and do not compromise user data.
– **Regulatory Compliance**: The claims of ‘compliance’ by the devs stress the importance of understanding the compliance landscape and ensuring that tools align with relevant privacy laws and regulations.
– **Incident Response Protocols**: As anomalies in behavior are reported, having a robust incident response strategy to address potential data breaches quickly becomes essential.
– **User Awareness**: Educating users about the permissions required by extensions and what those permissions imply for their data security should be a priority.
This case serves as a reminder of the risks associated with potentially insecure software solutions and the critical nature of ongoing vigilance within the security landscape.