Featured Chrome Browser Extension Caught Intercepting Millions of Users' AI Chats

A Google Chrome extension named Urban VPN Proxy, marketed as free VPN access with the “best secured” promise, has been observed silently harvesting conversations from users’ AI chats across platforms including OpenAI ChatGPT and Google Gemini, with about six million users reported. The extension, which is developed by Urban Cyber Security Inc, was updated to version 5.5.0 on 9 July 2025, with AI data harvesting enabled by default using hard-coded settings.

It achieves this through a tailored executor JavaScript that runs for each targeted chatbot and overrides fetch() and XMLHttpRequest() so every request is routed through the extension to capture prompts, chatbot responses, and related metadata, exfiltrating them to two remote servers. The data is shared with BIScience, an affiliated firm that collects and commercialises browsing data, and Urban Cyber Security Inc.

It’s noted that Chrome and Edge extensions auto-update by default, raising concerns about trust in marketplace badges such as the “Featured” label. According to Koi Security, the harvesting occurs even when a security feature to warn about data-sharing is shown, effectively bypassing the stated protections.