Is Affinity Pathfinder safe?

Medium risk

Affinity Pathfinder embeds each visited site's domain in an extension iframe URL that sampled Datadog RUM events can send off-device.

Affinity Pathfinder runs a content script on most pages and creates an extension iframe whose URL includes the current site's hostname. Its bundled app initializes Datadog RUM/logging, so sampled view events can include that chrome-extension URL with the domain query parameter.

Affinityv2.85.0Chrome Web Store
45Risk
Who publishes it

PROJECT AFFINITY, INC. - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Affinity
Declared legal entity
PROJECT AFFINITY, INC.
Registered address
170 Columbus Ave floor 3, San Francisco, CA 94133, US
Registered contact
Affinity
Website
support.affinity.co/s

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

support.affinity.co
Also called by 1 other listing: Groovin: Keep your CRM aligned with your prospecting workflow
affinity.co
Also called by 2 other listings, including Groovin: Keep your CRM aligned with your prospecting workflow

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Affinity Pathfinder reports the domain of every site you visit to Datadog

On every site outside a short exclude list, the extension opens an off-screen iframe whose URL contains that site's domain.

Datadog's bundled analytics SDK can sample this iframe URL, domain intact, and send it off the device.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any website that isn't Gmail, LinkedIn, Google, or one of Affinity's own domains.

Affinity Pathfinder's content script runs on every page except a short exclude list.

The extension did this

The extension builds an internal page URL containing that site's domain and loads it in an off-screen iframe.

The bundled Datadog analytics SDK can sample this iframe URL, domain included, and send it to Datadog.

Data placed in the outbound iframe URL
  • The domain of the site you're on
    www.bbc.com

    Lets an outside analytics vendor see which sites Affinity Pathfinder users browse, not just Affinity's own pages.

Captured request
POSThttps://browser-intake-datadoghq.com/api/v2/rum

202 Accepted (Datadog Browser SDK intake, fire-and-forget)

Body
{  "type": "resource",  "resource": {    "type": "xhr",    "url": "chrome-extension://mnfkepfkbemjhmpijcepabfhkldegbga/dist/export/profiles/organization.html?domain=www.bbc.com"  },  "view": {    "url": "chrome-extension://mnfkepfkbemjhmpijcepabfhkldegbga/dist/export/profiles/organization.html?domain=www.bbc.com"  }}
The code that does this

Reading the page's domain and building the tracked iframe URL

Readable version

Domain capture and exclusion gate, run on every page

dist_ext/prospect.js
(() => {  const e = (e => e.location.hostname)(window);  (({    document: e,    domain: t,    domains: n  }) => !(({    document: e  }) => "text/html" === e.contentType)({    document: e  }) || Ui(t, n))({    document,    domain: e,    domains: Bi  }) || (ii(), wy({    domain: e  }))})()

Builds the tracked iframe URL and inserts it into the page

dist_ext/prospect.js
wy = async ({  domain: e}) => {  if (!os()) {    const t = (({      pathname: e,      query: t = ""    }) => rs.appBaseUrl ? `${rs.appBaseUrl.origin}/${e}${t}` : chrome.runtime.getURL(`/dist/export/${e}.html${t}`))({      pathname: "profiles/organization",      query: `?domain=${e}`    });    by && vy({      cache: hy,      shadowRoot: by,      frameSrc: t,      container: my    }), ((e = {}) => {      d?.runtime.onMessage.addListener((async t => {        t.identifier === b.Affinity && await us({          extensionMessage: t,          handleContentMessage: e.handleContentMessage        })      })), (({        handleContentMessage: e      }) => {        window.addEventListener("message", (t => {          if (t.origin === (() => {              if (rs.appBaseUrl?.origin) return rs.appBaseUrl.origin;              let e = null;              try {                const t = d?.runtime?.getURL("");                e = t ? new URL(t).origin : null              } catch {}              return e            })() && t.data.identifier === b.Affinity) {            const n = t.data;            us({              extensionMessage: n,              handleContentMessage: e            })          }        }))      })(e)    })({      handleContentMessage: ky    }), ds({      type: h.Action,      params: {        messageName: y.Prospect,        domain: e,        sidePanel: await gs(d)      }    })  }};
Third-party destinations
    • browser-intake-datadoghq.com

    Datadog's RUM/session-replay intake; receives the extension's internal iframe URL, domain included, in sampled sessions.

Where it sends data

Destinations our analysis observed Affinity Pathfinder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • browser-intake-datadoghq.com

    Affinity Pathfinder sends data to browser-intake-datadoghq.com. One other extension we have analysed sends data here.

Updated 30 September 2026mnfkepfkbemjhmpijcepabfhkldegbga