What our analysis found

Windscribe VPN — Бесплатный VPN для Chrome и онлайн-сервисов is rated malicious by Extension Auditor. Our code review reported 2 findings (2 high), led by other. It comes from a publisher with 10 extensions and was last updated in July 2026.

Key findings

• high· other —The extension markets itself as "Windscribe VPN", the name of a real, established VPN vendor, but every endpoint it uses belongs to — a randomly-named domain with no connection to Windscribe (grep over all five code files finds no reference). Users are induced to hand all of their network traffic to an anonymous operator (publisher email maks.osokin2060@, privacy policies hosted as pastes) on the strength of a borrowed brand reputation, and:105-124 auto-opens that operator's site on install to funnel them into a "free premium" upsell. The publisher-level privacy policy is titled "Touch-VPN" — a second real brand — and carries unused randomized layout variants, indicating a clone-generation kit rather than a genuine vendor product.
• high· network interception —All browser traffic is routed through a single fixed proxy at with a bypass list of only `<local>` (:24-28), so the operator observes every hostname the user visits via CONNECT requests and can read and tamper with all plaintext HTTP. Browsing destinations are personal data, and the CWS listing declares no data collection at all, so this routing is undisclosed; the destination is not the publisher's stated brand (Windscribe) nor any domain named in the submitted privacy policy.:126-137 re-applies the proxy on every browser startup without user interaction, so the interception persists silently across sessions.

The code is a small, unobfuscated proxy toggle, but it impersonates the real VPN vendor Windscribe (:2,:6) while routing 100% of browser traffic through (:10,:28-50) — a domain with no relationship to Windscribe; `grep -rin windscribe` over all five code files returns only the borrowed brand string and class names, never. The operator therefore receives every hostname the user visits plus all plaintext HTTP, a data category the CWS listing declares as 'none collected', and:126-137 silently re-arms the proxy at every browser startup. Independent corroboration of a clone kit rather than a real vendor: the publisher-level privacy policy is titled 'Touch-VPN' (a second impersonated brand) and both policies are pastes rather than company pages,:4 carries a generator theme id ('v4-windscribe-frost'), and ships many unused randomized layout variants (shell--order-split-row, dial-btn--banner, dial-btn--arc, dial-btn--vcap, hd--terminal) absent from. Contradicting signals: the chrome-stats impact reason cites a clipboard permission that does not exist in this manifest, the bundled and published manifests match exactly, and there is no exfiltration endpoint, remote code loading, or obfuscation in the JS — the malice is the trust model, not the code complexity. I deliberately do not rest this verdict on the malext feed note, the publisher-malicious count, or the 38% permhash cluster, since those derive from imported labels rather than code.