Found 2 security flaws in ProtonVPN's Chrome/Brave extension

Site Feedback
1

  1. When using Brave or Chrome, if you access a website immediately upon launching the browser or if the browser is set to resume previous sessions, your IP address will be exposed before the Proton VPN extension fully loads/connects. This presents a significant security issue.

  2. Again with the Chrome/Brave Extension, if you enable “Secure Core” and “Auto Connect” it will auto connect without connecting to Secure Core. It’s not until you disconnect and reconnect that it connects via Secure Core.

I was very impressed with Proton’s desktop and iOS VPN app, but it is concerning they would release have baked Chrome Extension like this with obvious security flaws.

2

Have you duly notified proton?

3

I think this is something most extensions would also experience. Being browser based an active connection to the ISP would be created upon reopening the browser and the VPN extension would have a short period before it activates after. The way to mitigate that would be to use the VPN at OS level.