Is AegisWeb3 safe?

Medium risk

AegisWeb3 is medium risk. AegisWeb3's background script scans every open tab for its own ID, reads referral param 's2' from the newest match, and sends it to approve.aegisweb3.com. Testing confirmed a planted marker reached the server in seconds.…

AegisWeb3v0.7.1Chrome Web Store
51Risk
Who publishes it

AegisWeb3 - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AegisWeb3

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AegisWeb3 Scans Every Open Tab for a Referral Code at Install

AegisWeb3's background script scans every open tab for its own ID, reads referral param 's2' from the newest match, and sends it to approve.aegisweb3.com.

Testing confirmed a planted marker reached the server in seconds.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install AegisWeb3 while a tab is open to a URL that contains the extension's own ID and a referral code.

That is typically the Chrome Web Store listing itself, which can carry an affiliate 's2' code in its URL, but the check is not restricted to the Chrome Web Store's domain.

The extension did this

The extension reads that referral code and sends it to its own server, approve.aegisweb3.com.

This happens once, automatically, right after install, with no notification shown to you.

What the install handler reads, and what it sends onward
  • Referral code (s2)
    REF-8842-CG (illustrative)

    Ties this specific install to whichever referral link or ad campaign the code came from. This is the only value sent to AegisWeb3's server.

  • Open tab's web address
    https://chromewebstore.google.com/detail/aegisweb3/dakkielolpafjbgnjnakddabmbbkcioe?s2=REF-8842-CG (illustrative)

    Read locally on every tab to find one matching the extension's own ID. Only the referral code from the first match leaves the device.

The code that does this

The install handler that scans open tabs and reports the referral code

Readable version
chrome.runtime.onInstalled.addListener(async () => {  const tabs = (await chrome.tabs.query({})).reverse(); // most recently opened tab first  for (const tab of tabs) {    const url = tab.url || '';    if (url.toLowerCase().indexOf('dakkielolpafjbgnjnakddabmbbkcioe') <= 0) continue; // not a matching tab    // First tab whose URL contains the extension's own ID string —    // usually the Chrome Web Store listing the user just installed from,    // but the check is a plain substring test, not a domain check.    const s2 = new URL(url).searchParams.get('s2');    if (s2) {      fetch(`https://approve.aegisweb3.com/api/User/PluginData?s2=${s2}`).catch(() => {});    }    break; // only the first matching tab is ever inspected  }});
Captured request
GEThttps://approve.aegisweb3.com/api/User/PluginData?s2=<planted marker>

200 OK. Observed during dynamic analysis after the referral code was read from a matching tab.

Reproduce it yourself

Reproduces AegisWeb3's install-time tab-matching logic locally: given a list of open-tab URLs, it shows which one the extension would match and what request it would send, without contacting any server.

Requires
  • Node.js 14+
aegisweb3-install-tab-scan-reproducer.js · js
#!/usr/bin/env node// aegisweb3-install-tab-scan-reproducer.js//// Reproduces the tab-matching logic from AegisWeb3's chrome.runtime.onInstalled// handler (js/background.js). Given one or more "open tab" URLs (pass them in// the order chrome.tabs.query({}) would return them — oldest tab first), it// prints which tab the extension would match and what request it would send.// It never makes a network request itself.const EXTENSION_ID = 'dakkielolpafjbgnjnakddabmbbkcioe';function findOutboundRequest(openTabUrls) {  // The real handler calls chrome.tabs.query({}) then .reverse()s the  // result, so the most-recently-opened tab is checked first.  const tabs = [...openTabUrls].reverse();  for (const url of tabs) {    if (url.toLowerCase().indexOf(EXTENSION_ID) <= 0) continue;    // Matched a tab whose URL contains the extension's own ID.    const parsed = new URL(url);    const s2 = parsed.searchParams.get('s2');    if (s2) {      return `https://approve.aegisweb3.com/api/User/PluginData?s2=${s2}`;    }    return null; // matched, but no s2 parameter on this tab's URL  }  return null; // no open tab contained the extension's own ID}const testUrls = process.argv.slice(2);if (testUrls.length === 0) {  console.log('Usage: node aegisweb3-install-tab-scan-reproducer.js <tab-url> [<tab-url> ...]');  process.exit(1);}const request = findOutboundRequest(testUrls);console.log(request  ? `AegisWeb3 would send: GET ${request}`  : 'No matching tab, or no s2 parameter on the matching tab — no request would be sent.');
How to run it
  1. 1node aegisweb3-install-tab-scan-reproducer.js "https://chromewebstore.google.com/detail/aegisweb3/dakkielolpafjbgnjnakddabmbbkcioe?s2=REF-1234"

Site block list fetched hourly from unsigned Alibaba Cloud bucket

Every hour, the extension downloads a blocked-domains file from Alibaba Cloud storage.

New domains join the block list immediately with no update.

The file is unsigned, so whoever controls the bucket can add domains anytime.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

Once per hour, the background service worker wakes up and fetches the remote blocklist file.

The fetch runs at startup and repeats every 60 minutes regardless of user activity.

The extension did this

The downloaded domain list is stored locally and applied to every page you visit.

Any domain the remote operator adds to the list will cause the extension to intercept and replace that site with a block-list warning page.

When this fires

On an interval

Blocklist is refreshed from the remote server every hour, starting immediately on extension load.

The code that does this

Hourly blocklist fetch in background service worker

Readable version
// background.js — runs every hour starting on installscheduleHourly({ interval: 1, runNow: true, time: '00:00:00' }, async () => {  const response = await fetchJson(    'https://aegis-static.oss-accelerate.aliyuncs.com/ext/phishing-back-list.json'  );  if (response?.blacklist?.length > 0) {    await chrome.storage.local.set({ blacklist: response.blacklist });  }});
Remote blocklist host
    • aegis-static.oss-accelerate.aliyuncs.com

    Alibaba Cloud OSS bucket operated by the developer. Serves the block list as a plain unsigned JSON file. Whoever controls it can add any domain without a new extension version.

What it can do

Permissions this extension asks for, as declared in version 0.7.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Read and change your data on approve.aegisweb3.com

    https://approve.aegisweb3.com/*

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026dakkielolpafjbgnjnakddabmbbkcioe