It's almost unimaginable today that browser traffic used to be unencrypted and people in your network or down the line to your target could see and modify your traffic.

In 2013 I wrote an article about how to turn a Squid proxy into a code injection attack mechanism [1] (which many free proxies did at the time [2]). The most "harmless" would just replace the ads you see with their own, the worse ones used browser events to report all keystrokes or mouse positions to the attackers.

[1] https://blog.haschek.at/2013/05/why-free-proxies-are-free-js...

[2] https://blog.haschek.at/2015-analyzing-443-free-proxies/