Is AI Tab Master safe?
AI Tab Master rewrites shopping links with affiliate IDs and asks tabcategory.ptsolutionsnz.com for promoted AliExpress URLs.
On Amazon and Booking.com pages, its content script scans page links and adds or replaces affiliate parameters. On AliExpress pages, it sends the site hostname, merchant name, and product IDs from links to tabcategory.ptsolutionsnz.com/links, then replaces matching links with returned URLs.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AI Tab Master rewrites Amazon, Booking and AliExpress shopping links
On every Amazon, Booking.com and AliExpress page, the extension rewrites product and hotel links to carry its own affiliate identifiers.
Dynamic analysis captured 360 rewritten Amazon links and 109 on Booking.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open an Amazon product listing, a Booking.com search page, or an AliExpress category page.
The extension rewrites the shopping links on that page so they carry its own affiliate identifiers.
During dynamic analysis 360 links were rewritten on a single Amazon page and 109 on a Booking.com page, with no prompt or notice shown.
Each product link gains two marker classes and an affiliate tag belonging to the extension's operator.
- Target
- product links on an Amazon search results page
<a class="a-link-normal s-no-outline" href="/dp/B0G4SW3XXP"><a class="a-link-normal s-no-outline link-promotion link-processed" href="/dp/B0G4SW3XXP?tag=2431720-20">{"records":{"1005012935438745":"https://s.click.aliexpress.com/e/_oExAMPLE1","1005012753037778":"https://s.click.aliexpress.com/e/_oExAMPLE2"}} (product IDs are captured verbatim; the short-link codes are illustrative)
- The shop you are onwww.aliexpress.com
The exact merchant hostname of the page you have open.
- Which shop handler ranaliexpress
Tells the backend which merchant's link format to return.
- The products on your screen1005012935438745,1005012753037778,1005012918522610
The identifiers of every product listed on the page you are viewing, which reveals what you were browsing.
The affiliate identifiers and the rewrite routines
Hardcoded affiliate IDs, keyed by browser and Amazon host
deobfuscated/contentScript.jsvar u = "chrome", s = "edge", c = { default: a(a({}, u, "2431720-20"), s, "2431721-20"), "www.amazon.com.au": a(a({}, u, "2431720-22"), s, "2431721-22") }, f = a(a({}, u, "2431720"), s, "2431721"), l = { ALIEXPRESS: "aliexpress", AMAZON: "amazon", BOOKING: "booking" };The AliExpress backend lookup
deobfuscated/contentScript.jsreturn O({ path: "/links", data: { hostname: i, site: e, source_ids: u.join(",") }});// records from the response replace each anchor hreffor (m = t.sent, v = m.records ?? {}, h = 0, d = u; h < d.length; h++) y = d[h], G.set(y, v[y] || null);The Amazon and Booking.com href rewrites
deobfuscated/contentScript.js// Amazon: replace an existing tag= or append one to /dp/<asin>var o = (c[n] || c.default)[R()], i = "tag=".concat(o);if (t) return r.replace(t[0], i);return "".concat(f).concat(s, "?").concat(i);// Booking.com: replace an existing aid= or append itvar o = "aid=".concat(V);if (t) return r.replace(t[0], o);// dispatch, per merchantif ("booking" === t) return a(/aid=\d+/, function (t) { return Y(t, i) });if ("amazon" === t) return a(/tag=\w+-20/, function (t) { return X(t, i) });- tabcategory.ptsolutionsnz.com
Extension operator's backend. Receives the merchant hostname and the product IDs on your screen, and returns AliExpress affiliate redirect URLs.
- s.click.aliexpress.com
AliExpress affiliate redirect service. Your click is routed through it and credited to the operator's account.
- www.amazon.com
Product links are rewritten with tag=2431720-20, which enters Amazon's own affiliate redirect chain on click.
- www.booking.com
Hotel and search links are rewritten with aid=2431720, which Booking.com then echoes back through its own tracking calls.
What it can do
Permissions this extension asks for, as declared in version 1.8.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Read and change your tab groups
tabGroups
Where it sends data
Destinations our analysis observed AI Tab Master contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- tabcategory.ptsolutionsnz.com
AI Tab Master sends data to tabcategory.ptsolutionsnz.com. No other extension we have analysed sends data here.