What our analysis found

Vpnly Vpn - Бесплатный VPN для обхода блокировок showed no malicious code in Extension Auditor's review. It comes from a publisher with 13 extensions and was last updated in July 2026.

All 6 files are a minimal, readable (non-minified) MV3 proxy client::24-49 sets chrome.proxy to fixed_servers pointing at the hardcoded host from:10 (, scheme https),:51-63 clears it, and only renders and toggles that state — there is no, no content script, no host_permissions, no, no remote config and no obfuscation anywhere in the bundle, so a VPN extension doing exactly what its Privacy-&-Security listing describes. The corroborating signals are weak or self-contradictory: the Internal notes state the malware classification is an "import of external malicious-extension feed; not an independent code review" (the same feed drives the 92% publisher and likely much of the 38% permhash figure), the permhash cluster is simply the generic proxy+storage set every minimal VPN uses, and chrome-stats' top impact reason is permission-clipboard, which this manifest does not request. The bundled manifest matches the published manifest exactly (manifest_version 3, permissions proxy+storage); it is likely_benign rather than false_positive only because an anonymous operator (gmail author, privacy policies hosted on and rather than an owned domain) necessarily sees every hostname and all plaintext HTTP while declaring "none" data collection — unverifiable server-side residual risk, not a code defect.