What our analysis found

Turbo VPN - Бесплатный ВПН для браузера showed no malicious code in Extension Auditor's review. It comes from a publisher with 17 extensions and was last updated in July 2026.

The entire extension is 3 small, unminified, unobfuscated JS files::24-49 sets a hardcoded chrome.proxy pointing at, which shares an apex with the publisher's own premium link (:10-11), and is pure DOM rendering. A grep across every file finds no fetch, XMLHttpRequest, eval, atob, remote fetch, content script, host_permission, webRequest or onAuthRequired, so the extension does exactly and only what a proxy-based VPN must do, with the proxy applied solely on an explicit user click (:175 to:130) and install defaulting to disabled (:103-107). The 39%-malicious permhash cluster contradicts this reading and is the strongest opposing signal, but the remote-control markers that characterise those peers are absent here; chrome-stats' 'permission-clipboard' reason is a vendor error since neither the bundled nor the published manifest requests clipboard and no clipboard API appears in the code, and the publisher's malicious other extensions weakly corroborates. Residual risk is server-side and unauditable (the operator of the proxy sees every hostname), and listing hygiene is poor: the CWS description contains a pasted LLM reply, the privacy policy sits on, the publisher-level policy is titled '1click VPN', the theme string 'velocity-flame' suggests a templated generator, and the rating is 1.0. Those are template-farm signals, not code evidence, so the verdict is likely_benign rather than false_positive.