Is 楽天リーベイツ ポイントアシスト safe?
Rakuten Rebates Point Assist uploads full order-confirmation page HTML to Rakuten's capture server during active cashback trips.
When a cashback shopping trip is active and the user reaches an order-confirmation page, the extension reads the page's full HTML and sends it, compressed, with the store and trip IDs to capture.ecbsn.com. It also watches every main-frame page navigation to recognise partner stores, and sends usage events and browser details to analytics services including Datadog, Google Analytics, Segment and Rakuten's own endpoints.
Who publishes ithttps://www.rebates.jp - no other listings under this identity, 9 shared hostnames
https://www.rebates.jp - no other listings under this identity, 9 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 9 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Cashback extension uploads full order confirmation HTML to capture.ecbsn.com
Code analysis shows that on an activated cashback trip the extension sends the whole order-confirmation page HTML to capture.ecbsn.com.
The upload is on by default.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
User completes a purchase on a merchant site during an active cashback trip.
The extension uploads the full confirmation page HTML to capture.ecbsn.com.
Page capture in the content script and upload in the background
Content script, annotated
content/bundle.js// Content script: when the URL matches the merchant's order-confirmation regex,// read the entire page HTML (merchant 10226 reads an inner iframe instead).const html = document.documentElement.innerHTML;if (new RegExp(orderConfirmationURLRegex).test(location.href)) { resolve(html); // no field filtering or redaction}Handler, annotated
bg/bundle.js// Background: skip if logging is off or no active cashback trip ticket.if (!settings.loggingEnabled) return;const tripId = merchant && merchant.ttn;if (tripId) captureOrderPage({ content_type: "order confirmation", content_format: "html", shopping_trip_id: tripId, content_source: tabUrl, content: html });Upload, annotated
bg/bundle.js// Gzip the JSON and POST it.// Wr = "https://capture.ecbsn.com/api/1.0/commercecapture"POST Wr Content-Encoding: gzip body = gzip(JSON.stringify(payload))- content<html>...Order #112-3948571 ... Ship to ...</html>
The complete HTML of the order confirmation page, as rendered in the browser.
- content_sourcehttps://shop.example.com/checkout/confirmation?order=112-3948571
The address of the confirmation page, which can carry order identifiers.
- store_name / store_idExample Store / 10226
Which merchant the purchase was made at.
- shopping_trip_idttn-7f3a91c2 (illustrative)
The cashback trip ticket that links the page to this browser.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 0.1.20. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Read and change cookies, including the ones that keep you signed in
cookies
See the address and title of every tab you have open
tabs
See every page you navigate to, as you navigate to it
webNavigation
Watch every request your browser makes
webRequest
Store data in your browser
storage
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed 楽天リーベイツ ポイントアシスト contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.segment.io
楽天リーベイツ ポイントアシスト sends data to api.segment.io. 22 other extensions we have analysed send data here.
- google-analytics.com
楽天リーベイツ ポイントアシスト sends data to google-analytics.com. 11 other extensions we have analysed send data here.
- capture.ecbsn.com
楽天リーベイツ ポイントアシスト sends data to capture.ecbsn.com. 5 other extensions we have analysed send data here.
- events.engager.ecbsn.com
楽天リーベイツ ポイントアシスト sends data to events.engager.ecbsn.com. 2 other extensions we have analysed send data here.
- bl.ecbsn.com
楽天リーベイツ ポイントアシスト sends data to bl.ecbsn.com. One other extension we have analysed sends data here.
- logs.browser-intake-datadoghq.com
楽天リーベイツ ポイントアシスト sends data to logs.browser-intake-datadoghq.com. No other extension we have analysed sends data here.