Chrome Web Store
8Versions
4Code reviewed

No malware found

In code review (v1.4.0)

Our reviewer read version 1.4.0 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

10 indicators in this extension

10 indicators
4 versions analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

Internxt VPN, used by 20,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites and can observe network requests. It comes from a trusted publisher and was last updated in October 2026.

Analyst notes

The code is a coherent, first-party VPN client: the popup sets chrome.proxy to mode:'fixed_servers' pointing at Internxt's own node (:8348-8380),:2847 answers only proxy auth challenges (n.isProxy) with the Internxt JWT, and every network destination is an [domain withheld] subdomain ([domain withheld], [domain withheld]) plus [domain withheld] for displaying the user's own — no outbound data flow carrying browsing or page content exists anywhere in the three JS files. The content script exits unless the page origin is [domain withheld] and only receives a login token via postMessage (:36-70), so <all_urls> is unused in practice. Contradicting signals: the Risk Engine, our 0.78 ML score and chrome-stats are all manifest-derived ( is the minimum permission set any Chrome VPN needs), chrome-stats even cites a 'clipboard' permission the manifest does not request; corroborating-against-malice: Google trusted-publisher badge, VALID publisher email on [domain withheld], and feedback ('only one node', 'proxy password prompts') match exactly what the code does. The 'publisher flagged malicious' bit and the permhash cluster's come from IoC-feed notes ([domain withheld] WhatsApp spamware, Pulsedive compromised-extensions) whose payload shapes are absent from this build — I did not verify they ever referred to this ID, so I do not treat them as evidence either way. Hygiene, not findings: the proxy is scheme 'http' to a raw IP with the JWT as Basic proxy-auth, so the token travels cleartext, and after RESET_PROXY restores mode:'system' the onAuthRequired listener still has no challenger check and would hand that JWT to any proxy that asks; the origin test is a substring `includes` rather than equality. Held at likely_benign rather than false_positive only because ~380KB of vendored bundle was grepped rather than read line by line.

Internxt VPN

Internxt VPN Chrome extension security report

ID: dpggmcodlahmljkhlmpgpdcffdaoccni

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
1.5.0
Size
0.18 MB
Rating
3.9/5
Reviews
117
Users
20,000
Type
Extension
Updated
Oct 9, 2026
Category
Privacy & security
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
1extension
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
internxt.com
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Users
20,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
proxy
Permission
Critical
This permission allows the extension to control the browser's proxy settings. Rated Critical because it can route all traffic through potentially malicious proxies, enabling man-in-the-middle attacks and traffic monitoring.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestAuthProvider
Permission
Critical
This permission allows the extension to handle authentication requests and modify authentication headers. Rated Critical because it can intercept login credentials, session tokens, and modify authentication flows to compromise accounts.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
*://*/*
Risk Factor
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

10 indicators in this extension

10 indicators
4 versions analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

Internxt free VPN: an encrypted, secure VPN built to protect your privacy.

Read the publisher’s full description

Are you tired of being blocked by websites? Do you want to avoid the risks of Public Wi-Fi and keep your data protected while surfing the web? This VPN extension for Chrome hides your IP address, encrypts your data, and keeps your browsing experience private, secure, and unrestricted. We also encrypt your internet connection to scramble your data, keeping you safe from network attacks and leaks. Encrypting your traffic with a private VPN also stops hackers from viewing sensitive information. Download for free and instantly start browsing in complete freedom and peace of mind, knowing that your privacy is protected. Benefits of the VPN include: - Free VPN: 100% free. No credit card details are required. - Unlimited VPN: Truly unlimited. No session, speed, or bandwidth limitations. - Simple: You will instantly connect to a new location once you click connect. - Secure VPN: Our military-grade post-quantum encryption allows you to browse anonymously and securely. How the Internxt VPN protects you online - Prevent targeted ads - Bypass annoying Geo-restrictions - Protect your online privacy - Strict no-logs policy - Increased online privacy - Surf the Web Anonymously. - Quick, easy to use, and 100% free. Download for free, connect, and start surfing securely. It’s that simple! How do I enable the VPN? - Add the VPN browser extension to your browser - Click the Internxt VPN icon in the top right of your browser - Click the toggle button next to “VPN Protection” to activate - You're done! You can now securely and privately browse the internet! About Internxt Internxt provides a suite of internet services that protect your privacy online with our post-quantum zero-knowledge encrypted products. This VPN is part of our mission to provide everyone with a more secure, private online experience. Download it for free to keep your data safe from hackers, data breaches, and tracking. Privacy Policy Internxt values the privacy of our users. We protect your data with our free VPN and our other product suites; we do not store or collect your data. Our zero-knowledge encryption policy ensures that no hackers, businesses, or even Internxt can view your encrypted data. We do not share data with third parties, and we do not include any ads in our services. Learn more at https://internxt.com/

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs
9
IPv4
1

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

10 indicators in this extension

10 indicators
4 versions analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
1.5.0
Latest
0.18 MBNot scanned—
3d9eb1837d984b5d07f6063f731232d6b45100d08554e7342f832622b898efcb
1.1.2
0.14 MBNo malware found0
6b39681a2a8b4e64c2e88c7219dd0d8c488e3448ec95b941e37246aa37b02dc3
1.1.1
0.14 MBMalicious0
6b39681a2a8b4e64c2e88c7219dd0d8c488e3448ec95b941e37246aa37b02dc3
1.1.0
0.14 MBCaution0
6b39681a2a8b4e64c2e88c7219dd0d8c488e3448ec95b941e37246aa37b02dc3
1.0.0
0.14 MBNot scanned—
6b39681a2a8b4e64c2e88c7219dd0d8c488e3448ec95b941e37246aa37b02dc3
1.4.0
0.17 MBNo malware found0
2c5f565cfb44a49ef0d8b8fe2976a65b2e4eb925a105b88351eaf905208d8dbf
1.3.0
0.16 MBNot scanned—
2c5f565cfb44a49ef0d8b8fe2976a65b2e4eb925a105b88351eaf905208d8dbf
1.2.0
0.14 MBNot scanned—
6b39681a2a8b4e64c2e88c7219dd0d8c488e3448ec95b941e37246aa37b02dc3
Showing 1 to 8 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Popular in Privacy & Security