Security Warning: High Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: Glitch VPN — Proxy for Browser

HIGH RISK

Glitch VPN — Proxy for Browser

ID: nlgfopkcogghmcdedkghgpbpfofmjogk

Supported Languages

🇨🇳Chinese (Simplified)

🇺🇸English

🇩🇪German

🇷🇺Russian

🇪🇸Spanish

🇹🇷Turkish

Extension Info & Metadata

Status

Active

Version

0.3.11

Size

18.37 MB

Rating

4.2/5

Reviews

Users

945

Type

Extension

Updated

Feb 20, 2026

Publisher Contextual Analysis

Trusted

Author: GLITCH LABS LLCView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

945

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Privacy-first Browser VPN. No activity logs. Smart site rules (allowlist). Anonymous 16-digit code login. Fast & secure.

Glitch VPN is a privacy-first BROWSER VPN (secure proxy). It routes your BROWSER TRAFFIC through the Glitch network with NO ACTIVITY-LOGS and a minimal, distraction-free UI. 🚀 KEY FEATURES 🔹 Per-site rules: Smart allowlist/blocklist for domain-based routing. Choose exactly which sites use the VPN. 🔹 Anonymous Access: No email or password required. We use a random 16-digit code for authentication. 🔹 Global Network: High-speed premium servers in multiple locations worldwide. 🔹 Data Minimization: We do not track bandwidth per user history or DNS queries. ⚙️ HOW IT WORKS 1. Install the extension. 2. Enter your anonymous access code (purchase via our website or Telegram bot). 3. Click "Connect" to secure your browser traffic. ⚠️ IMPORTANT NOTES • Browser Proxy: This extension protects traffic INSIDE YOUR BROWSER only. It is not a system-wide VPN. For full device protection, use our desktop or mobile apps. • Subscription: Access requires a valid plan. Payments are processed via Telegram Stars or Cryptocurrency for maximum privacy. 🛡️ PRIVACY We operate with NO ACTIVITY-LOGS. Our servers pipe logs to /dev/null. We do not record traffic content, DNS queries, or IP history. 🔗 LINKS & SUPPORT • Website: https://glitchvpn.app • Legal: See the "Legal" section on our website. • Support: [email protected] or https://t.me/glitch_vpn_support_bot

User Growth

Showing data from Dec 23, 2025 to Aug 02, 2026

Versions

+7.98%(+68 users)

Compared to 3 months ago

8 versions released in this period

Rating Count

Total: 21 ratings

Average Rating

Current: 4.05 / 5.0+4.05

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium7

Low4

Versions scanned

Showing 3 of 7 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.3.11 Code review	7
0.3.10 Code review	3
0.3.8 Code review	5

Extension Version	Code Review Findings
0.3.11	7
0.3.10	3
0.3.8	5

Files with findings

2 distinct paths — top paths by unique finding count:

background.js14
popup.7717bff3.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	high	background.js (line 1147)	The extension hand-builds raw DNS query packets and posts them to dns.google's DoH endpoint to retrieve TXT records from a third-party domain (edge-atx-419.online). Using DoH plus a manually-crafted DNS message bypass…	0.3.11
2	Obfuscation	high	background.js (line 1235)	Returned TXT records are masquerading as Google site-verification entries (constant O = "google-site-verification="). The base64 payload is split on '.' bytes, AES-GCM decrypted, and the JSON {h, p} fields become the …	0.3.11
3	Obfuscation	high	background.js (line 1221)	The 64-byte PBKDF2 password and 15-byte salt used to decrypt the DNS-delivered API host are not stored in plaintext — they are reconstructed at runtime by XORing two pairs of hard-coded byte arrays (L^N, U^R). This sp…	0.3.11
4	Remote Code Loading	high	background.js (line 1322)	The real backend hostname the extension talks to is not the stated ghost.glitch.zone — at runtime the extension resolves edge-atx-419.online (a separate, undocumented .online domain) and uses the encrypted TXT respons…	0.3.11
5	Network Interception	medium	background.js (line 2375)	The extension installs a proxy.onRequest handler and a webRequest.onAuthRequired listener bound to <all_urls>, supplying stored proxy credentials for any matching challenge. Combined with the dynamically resolved (and…	0.3.11
6	Network Interception	medium	background.js (line 1148)	Custom hand-rolled DNS-over-HTTPS client that posts a binary DNS query to dns.google/dns-query and parses TXT answers manually. Combined with the AES-GCM-encrypted payload below, this is a covert channel for retrievin…	0.3.8
7	Obfuscation	medium	popup.7717bff3.js (line 530)	The same XOR-obfuscated AES-GCM key/salt material and DoH-TXT-decrypt logic are duplicated inside the popup bundle, meaning even the user-facing UI, not just the service worker, performs covert API-host resolution. Du…	0.3.11
8	Obfuscation	medium	background.js (line 1322)	The extension fetches its real backend host at runtime by issuing a DNS-over-HTTPS query to dns.google for TXT records on the unrelated domain 'edge-atx-419.online', then picking a record disguised with a 'google-site…	0.3.10
9	Obfuscation	medium	background.js (line 1323)	The extension does not hard-code the production API host. Instead it issues a DNS-over-HTTPS query to Google's resolver for TXT records on `edge-atx-419.online` (a domain unrelated to the user-facing `glitch.zone` bra…	0.3.8
10	Obfuscation	medium	background.js (line 1222)	The PBKDF2 password and salt used to decrypt the DoH-delivered backend host are stored as two XOR-split byte arrays each, so neither half on its own reveals the secret to a static scanner. A third XOR pair (D ^ k) is …	0.3.8
11	Remote Code Loading	medium	background.js (line 1236)	The TXT-record payload is base64-decoded, split into IV/salt/ciphertext, then AES-GCM decrypted with a key derived via PBKDF2 (100k iterations, SHA-256). The decrypted JSON yields {h: host, p: port} — i.e., the actual…	0.3.10
12	Obfuscation	low	background.js (line 1221)	The PBKDF2 input key and salt used to decrypt the dead-drop TXT record are stored as XOR-split byte arrays and reconstructed at runtime. There is no functional reason to XOR-split a key inside an extension that ships …	0.3.10
13	Obfuscation	low	background.js (line 2626)	A bearer token embedded in the extension is reconstructed at runtime by XORing two byte arrays (D ^ k) and sent in the Authorization header to the geo IP endpoint. The token is deliberately not present in plaintext in…	0.3.8
14	Tracking	low	background.js (line 2991)	On uninstall, the extension opens a server-controlled URL with the user's device_id, support_code and user code embedded as query parameters. The base host is geo-switched to web.try-glitch.com when the user appears t…	0.3.11
15	Tracking	low	background.js (line 2874)	On uninstall the extension forces a navigation to a server-controlled URL with the user's persistent device_id, account `code`, and `support_code` appended. This guarantees the operator receives an attributable post-u…	0.3.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ghost.glitch.zone	-	https://ghost.glitch.zone
dns.google	/dns-query	https://dns.google/dns-query
https:	-	https://${e.host}`:`https://${e.host}:${e.port}`}class
geo.${r}`;return	-	https://geo.${r}`;return
web.glitch.zone	-	https://web.glitch.zone
web.try-glitch.com	-	https://web.try-glitch.com
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
chromewebstore.google.com	/detail/glitch-vpn/nlgfopkcogghmcdedkghgpbpfofmjogk/reviews	https://chromewebstore.google.com/detail/glitch-vpn/nlgfopkcogghmcdedkghgpbpfofmjogk/reviews

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Не работает

Kurona D·14 Jul 2026

найс впн 🙂

Jimbo Jambo·2 Jun 2026

включаю расширение просят отзыв, окей ребят вот вам отзыв) расширение постоянно отваливается на винде, у бесплатных та же проблема, 0 понимания за что вы деньги просите при подписке, продлевать не планирую

izee kill·1 Jun 2026

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Warning: High Security Risk

Glitch VPN — Proxy for Browser

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 7 Versions15

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating