In a shocking revelation, over 8 million users have had their AI conversations intercepted by several popular browser extensions. These extensions, including Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker, were found to be secretly collecting chat data from AI platforms such as ChatGPT, Claude, and Gemini. Despite having ‘Featured’ badges from Google and Microsoft and appearing to offer legitimate services like VPN and ad-blocking, these extensions injected malicious scripts that intercepted and exfiltrated user prompts, responses, and metadata without user consent.
The data harvesting was enabled through updates introduced in July 2025 and affects users regardless of whether VPN features are active. Moreover, users cannot disable this data collection through extension settings; the only option to stop it is by fully uninstalling the extensions. The exfiltrated data is allegedly shared with third-party servers for commercial purposes, potentially benefiting data brokers and violating several privacy norms. While Urban VPN discloses data collection practices in their privacy policy, it misleadingly claims not to sell information to third parties, exploiting loopholes in Chrome Web Store policies.
This incident highlights significant privacy risks associated with browser extensions, even those that carry high ratings and featured statuses after passing manual reviews. It underscores the need for enhanced scrutiny of such software and vigilance among users regarding the permissions granted to browser extensions they choose to install.

Collections

Over 8 million users had their AI conversations intercepted by popular browser extensions including Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker. These extensions, despite having 'Featured' badges from Google and Microsoft, injected malicious scripts to collect chat data from ChatGPT, Claude, and Gemini without user consent. The data harvesting began in July 2025 and cannot be disabled through settings—only full uninstallation stops it. The collected data is allegedly shared with third-party servers for commercial purposes, highlighting significant privacy risks even with highly-rated, manually-reviewed extensions.

Urban VPN Extensions Exploit Users' AI Chats, Undermining Privacy Claims