What our analysis found

Touch VPN — Приватный VPN для безопасного подключения, used by 1,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by network interception. It comes from a publisher with 10 extensions and was last updated in August 2026.

Key findings

• high· network interception —The extension unconditionally routes all browser traffic through the operator-controlled proxy at. The domain is not associated with any known VPN provider, and the published privacy policy is an anonymous page with no identifiable legal entity, meaning the proxy operator has no accountability for how they handle intercepted traffic, including HTTP content and HTTPS This grants a full MITM position to whoever controls this server.

The extension's code is small, readable, and does exactly what a VPN proxy toggle should do: it sets a fixed HTTPS proxy () for the browser scope and clears it on disable. There is no obfuscation, no remote code loading, and no hidden data exfiltration within the extension bundle itself. However, the proxy operator is unidentifiable — the 'privacy policy' is an anonymous post with no legal entity, the domain ' ' is not associated with any established VPN provider, and the extension is only 36 days old with a suspiciously high 148-review count against only 342 users. Routing 100% of browser traffic through an unaccountable proxy gives the server operator a full MITM position on all HTTP traffic and HTTPS metadata; the ML score (0.50) and 12% malware rate in the permhash cluster corroborate the concern without providing decisive proof of in-extension malice.