Featured Chrome Browser Extension Caught Intercepting Millions of Users' AI Chats

[Brownie2019]

Content source

https://thehackernews.com/2025/12/featured-chrome-browser-extension.html

A Google Chrome extension with a "Featured" badge and six million users has been observed silently gathering every prompt entered by users into artificial intelligence (AI)-powered chatbots like OpenAI ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, xAI Grok, Meta AI, and Perplexity.

The extension in question is Urban VPN Proxy, which has a 4.7 rating on the Google Chrome Web Store. It's advertised as the "best secured Free VPN access to any website, and unblock content." Its developer is a Delaware-based company named Urban Cyber Security Inc. On the Microsoft Edge Add-ons marketplace, it has 1.3 million installations.

Read more on:

Featured Chrome Browser Extension Caught Intercepting Millions of Users' AI Chats

Urban VPN extensions collect AI prompts, responses, and browsing data from millions through hidden code.

thehackernews.com

 

[Bot]

Read more on:

Featured Chrome Browser Extension Caught Intercepting Millions of Users' AI Chats

Urban VPN extensions collect AI prompts, responses, and browsing data from millions through hidden code.

thehackernews.com

If this report is accurate, it’s a very good reminder of how much power browser extensions have and how little the “Featured” badge or high ratings actually guarantee.

Key points / implications

• Any extension that can see web content (especially on all sites) can potentially:
  • Read everything you type into AI chatbots (prompts, API keys, passwords, internal docs).
  • Exfiltrate that data to a remote server without obvious signs.
  • Bypass “incognito” in practice if you’ve allowed it there.
• “Featured”, “Editor’s choice”, or high ratings are not security guarantees. Malicious or abused extensions have slipped through Chrome Web Store / Edge Add-ons review in the past.
• VPN/proxy extensions are especially risky because they:
  • Often request broad permissions.
  • Handle lots of sensitive traffic (logins, searches, chats, corporate/education portals).

What to do if you’ve used Urban VPN (or similar) with AI chats

• Uninstall the extension immediately from Chrome/Edge:
  • Chrome: Menu → Extensions → Manage extensions → remove it.
  • Edge: Menu → Extensions → Manage extensions → remove it.
• Revoke tokens / API keys used with AI services:
  • OpenAI, Anthropic, Gemini, etc. – regenerate or revoke any API keys you may have pasted into web UIs or pages the extension could see.
• Change passwords if you ever entered them on sites while the extension was active (especially if you reused them anywhere else).
• Review account security:
  • Check recent sign‑ins / sessions for your main accounts (Google, Microsoft, OpenAI, etc.).
  • Enable 2FA everywhere you can.
• Treat past prompts as potentially exposed:
  • Assume anything highly sensitive you typed (internal docs, PII, credentials, proprietary code) could be in someone else’s logs.
  • If this involved work data, consider informing your organization’s IT/security team.

Safer habits with browser extensions

• Minimize extensions: only keep what you truly need; fewer extensions = smaller attack surface.
• Check permissions:
  • Prefer extensions limited to specific sites instead of “Read and change all your data on all websites”.
  • If an extension doesn’t need access to page content, don’t grant it.
• Prefer native apps or system VPNs over browser‑only VPN extensions, especially for sensitive work.
• Review extensions regularly: uninstall anything you don’t recognize or no longer use.

About the specific case
My knowledge is current only up to October 2024, so I can’t independently verify this specific December 2025 report or its details. I have to rely on what you’ve posted and the general pattern of similar incidents. For confirmation and any mitigation advice specific to this extension, I’d suggest:

• Checking the latest comments / reviews on the Chrome Web Store and Edge Add-ons page.
• Looking for statements from:
  • Google Chrome Web Store / Microsoft Edge Add-ons team.
  • The developer (Urban Cyber Security Inc.), if they respond.
• Following coverage from other reputable security sources (e.g. vendor blogs, CERTs).

If you share how you were using the extension (just casual browsing vs. work, API keys, internal portals, etc.), I can help you prioritize what to lock down first.

 

[cartaphilus]

Read more on:

Featured Chrome Browser Extension Caught Intercepting Millions of Users' AI Chats

Urban VPN extensions collect AI prompts, responses, and browsing data from millions through hidden code.

thehackernews.com

#1 mantra for everything in life: "IF it's FREE then YOU ARE THE PRODUCT"