What our analysis found

Express vpn - Бесплатный для youtube Chrome is rated caution by Extension Auditor. Our code review reported 2 findings (1 critical, 1 high), led by network interception. It comes from a publisher with 12 extensions and was last updated in July 2026.

Key findings

• critical· network interception —Sets a browser-wide fixed_servers proxy to (:10) with bypassList ['<local>'] only, so every remote hostname the user visits is sent to that operator, and all plaintext http:// traffic passes through it in the clear (TLS bodies remain encrypted absent a CA install, but CONNECT hostnames do not). The extension's CWS listing declares no data collection, so this browsing-destination stream is wholly undisclosed, and the operator domain is an unattributed.space host with no identity beyond a page.:120-131 re-applies this on every browser startup once enabled.
• high· other —The extension brands itself as ExpressVPN (name in and VPN_NAME here, ExpressVPN marketing copy in the CWS description, ExpressVPN red styling in) while being published by an unrelated gmail account whose policy pages are posts, one titled for a different product. The impersonation is what induces users to grant the proxy permission and hand their entire traffic path to, a domain with no connection to ExpressVPN.:109-117 also force-opens that site in a tab on install.

The code is a small, unobfuscated MV3 proxy toggle, but it impersonates the ExpressVPN brand ( name,:2) while routing every non-local request through an anonymous operator's host (:10,:26-48) with bypassList limited to ['<local>'], and the CWS listing declares no data collection at all, so the full browsing-destination stream reaching that host is undisclosed. The publisher is a gmail address whose only policy documents are pages, one of them titled for a different product (Astar-VPN). Bundled and published manifests match exactly (proxy, storage), so there is no delayed-update mismatch; the ML regex evidence is trivial and does not corroborate anything (the single js_innerhtml hit is:107 clearing a list, there is no eval, no remote code, no network calls in the code), and chrome-stats' 'permission-clipboard' reason is simply wrong for this manifest and contradicts rather than supports the flag. Publisher reputation ( other extensions malicious), the 38%-malicious permhash cluster, and a 4.9 rating from 222 reviews on only 490 users are corroborating context only, not the basis of the verdict.