BreachPublished 16 Dec 2025

Urban VPN Browser Extension Caught Harvesting AI Chat Conversations from Millions of Users

Source Reddit NetSec

Description

The Urban VPN browser extension and related extensions from the same publisher have been found to covertly harvest AI chat conversations from millions of users. Hidden scripts injected into AI chat services intercept all prompts and responses, capturing conversation content, timestamps, and session metadata. This data is sent back to Urban VPN’s servers regardless of whether the VPN is active, and users cannot opt out except by uninstalling the extension. The data collection feature was silently introduced via an auto-update in July 2025, affecting over 8 million installs. Despite advertising an “AI protection” feature, the extension fails to prevent data exfiltration and merely warns users about data sharing. Users who have used these extensions with AI chat services should consider their interactions compromised and remove the extension immediately.

Impact

For European organizations, the impact of this threat is significant due to the potential exposure of sensitive AI chat interactions, which may include proprietary business information, personal data, or confidential communications. The unauthorized collection and transmission of such data violate GDPR regulations, exposing organizations to regulatory penalties and reputational damage. The silent nature of the data harvesting and the inability to opt out exacerbate the risk, as users may unknowingly leak sensitive information. Additionally, the breach undermines trust in browser extensions and AI services, potentially disrupting workflows that rely on these tools. Organizations using Urban VPN or related extensions risk data leakage that could facilitate further targeted attacks, espionage, or intellectual property theft. The widespread installation base increases the likelihood that European users and enterprises are affected, especially those leveraging AI chat platforms for business operations. This threat also highlights the risks of third-party software supply chain components and the need for stringent vetting of browser extensions.

Defensive guidance

European organizations should immediately audit their environments for the presence of Urban VPN and related extensions, prioritizing their removal from all user devices. Implement endpoint management policies that restrict or block the installation of unapproved browser extensions, especially those with elevated permissions. Educate users about the risks of installing extensions from untrusted sources and the importance of scrutinizing permissions and update changes. Employ network monitoring to detect unusual outbound traffic patterns indicative of data exfiltration to Urban VPN servers. Consider deploying browser security tools that can detect and block script injection or unauthorized data interception. For organizations using AI chat services, establish guidelines to avoid sharing sensitive or confidential information through browser-based AI tools until the threat is fully mitigated. Engage with legal and compliance teams to assess potential GDPR impacts and prepare incident response plans for data breach notifications if necessary. Finally, monitor for updates from Urban VPN or security advisories to stay informed about remediation or further developments.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Dec 2025, 15:05 UTC

Technical details

References

Community reviews

Related threats