Is AiPrice(AliPrice) Search by Image for China Import Beta safe?
AiPrice(AliPrice) sends page URLs, titles, and referrers from all HTTP and HTTPS pages to analytics endpoints.
AiPrice(AliPrice) runs content scripts on all HTTP and HTTPS pages and sends analytics beacons that include the current page URL, title, referrer, screen size, language, extension version, and user/session identifiers. Because the scripts match all pages, this can include non-shopping browsing pages as well as pages where users use the extension.
Who publishes itaiprice4 - 11 other listings from the same operator, 2 of them carrying a finding
aiprice4 - 11 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
11 other listings published from this account, 108k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AiPrice sends every page you visit to Google Analytics and Matomo
We observed the extension's content script send the URL, title, and referrer of a page you visited to Google Analytics and a third-party Matomo server.
This happens on ordinary HTTP/HTTPS pages, not just shopping sites.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any website, shopping-related or not.
The extension's content script is injected into every HTTP and HTTPS page, including iframes.
The extension sends that page's URL, title, and referrer to Google Analytics and to a Matomo analytics server it controls.
The beacons fire automatically; no click or feature use is required.
- Page URLhttps://www.ebay.com/sch/i.html?_nkw=usb+cable
The exact address of the page you're viewing, sent on every navigation.
- Page referrerhttps://www.google.com/search?q=usb+cable
The page you came from, which can reveal a search query or a prior site.
- Page titleusb cable | eBay
The text of the page's title bar, sent alongside the URL.
- Extension user IDemmkilo-106014093d-235m234m0s3v
A persistent identifier tied to your install, letting the analytics vendor link every page you visit to the same profile over time.
- Session ID1757347200000
A short-lived ID that groups your beacons into a single browsing session.
Sent via navigator.sendBeacon; no response body observed.
en=page_view&_ee=1&_et=Sent via navigator.sendBeacon; no response body observed.
url=https%3A%2F%2Fwww.ebay.com%2Fsch%2Fi.html%3F_nkw%3Dusb%2Bcable&uid=<extension-generated id>&action_name=usb cable | eBayThe page-URL beacon fields are added unconditionally
const buildAndSendGaBeacon = async (eventName = "", action = "", params = {}) => { if (isEmpty(eventName)) return; try { const extUid = await getExtUid(); const sessionId = await getSessionId(); const countryCode = await getCountryLanguage(); const lang = await getBrowserLanguage(); const commonParams = getCommonHttpParams(); // ...build query string `r` from event/action/params... if (r.trim().length > 0) { let pageFields = {}; // `sendPageFields` is hardcoded false, so `pageFields` is ALWAYS populated // with the live page URL, referrer, and title - there is no opt-out path. const sendPageFields = false; if (!sendPageFields) { pageFields = { dl: globalThis.document?.location?.href || "", // page URL dr: globalThis.document?.referrer || "", // referrer dt: globalThis.document?.title || "" // page title }; } const screenRes = globalThis.screen ? `${globalThis.screen.width}x${globalThis.screen.height}` : ""; const beaconUrl = setURLQuery(GA_COLLECT_URL, { v: "2", tid: GA_MEASUREMENT_ID, cid: extUid, sid: sessionId, sr: screenRes, ...pageFields, ul: lang, sct: 1, seg: 1, _et: 100, _p: randomStr(9, "0123456789"), _s: ++beaconCounter }); if (navigator?.sendBeacon && navigator.sendBeacon(beaconUrl, r)) return true; } } catch (_) {}};- www.google-analytics.com
Google's analytics collection endpoint; receives the page URL, title, referrer, and a persistent extension user ID on every navigation.
- matomo.chnprice.com
A Matomo analytics instance on a domain tied to the extension's operator; receives the same page URL and a separate user ID, unconditionally enabled.
Where it sends data
Destinations our analysis observed AiPrice(AliPrice) Search by Image for China Import Beta contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
AiPrice(AliPrice) Search by Image for China Import Beta sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- matomo.chnprice.com
AiPrice(AliPrice) Search by Image for China Import Beta sends data to matomo.chnprice.com. No other extension we have analysed sends data here.