Is AiPrice(AliPrice) Search by Image for China Import Beta safe?

Medium risk

AiPrice(AliPrice) sends page URLs, titles, and referrers from all HTTP and HTTPS pages to analytics endpoints.

AiPrice(AliPrice) runs content scripts on all HTTP and HTTPS pages and sends analytics beacons that include the current page URL, title, referrer, screen size, language, extension version, and user/session identifiers. Because the scripts match all pages, this can include non-shopping browsing pages as well as pages where users use the extension.

aiprice4v4.1.6Chrome Web Store
45Risk
Who publishes it

aiprice4 - 11 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AiPrice sends every page you visit to Google Analytics and Matomo

We observed the extension's content script send the URL, title, and referrer of a page you visited to Google Analytics and a third-party Matomo server.

This happens on ordinary HTTP/HTTPS pages, not just shopping sites.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any website, shopping-related or not.

The extension's content script is injected into every HTTP and HTTPS page, including iframes.

The extension did this

The extension sends that page's URL, title, and referrer to Google Analytics and to a Matomo analytics server it controls.

The beacons fire automatically; no click or feature use is required.

What each analytics beacon carries
  • Page URL
    https://www.ebay.com/sch/i.html?_nkw=usb+cable

    The exact address of the page you're viewing, sent on every navigation.

  • Page referrer
    https://www.google.com/search?q=usb+cable

    The page you came from, which can reveal a search query or a prior site.

  • Page title
    usb cable | eBay

    The text of the page's title bar, sent alongside the URL.

  • Extension user ID
    emmkilo-106014093d-235m234m0s3v

    A persistent identifier tied to your install, letting the analytics vendor link every page you visit to the same profile over time.

  • Session ID
    1757347200000

    A short-lived ID that groups your beacons into a single browsing session.

Captured request
POSThttps://www.google-analytics.com/g/collect?v=2&tid=G-PJYG13CDGZ&cid=emmkilo-106014093d-235m234m0s3v&sid=1757347200000&sr=800x600&dl=https%3A%2F%2Fwww.ebay.com%2Fsch%2Fi.html%3F_nkw%3Dusb%2Bcable&dr=https%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dusb%2Bcable&dt=usb%20cable%20%7C%20eBay&ul=en-us&sct=1&seg=1

Sent via navigator.sendBeacon; no response body observed.

Body
en=page_view&_ee=1&_et=
Captured request
POSThttps://matomo.chnprice.com/matomo.php?idsite=9&rec=1

Sent via navigator.sendBeacon; no response body observed.

Body
url=https%3A%2F%2Fwww.ebay.com%2Fsch%2Fi.html%3F_nkw%3Dusb%2Bcable&uid=<extension-generated id>&action_name=usb cable | eBay
The code that does this

The page-URL beacon fields are added unconditionally

Readable version
const buildAndSendGaBeacon = async (eventName = "", action = "", params = {}) => {  if (isEmpty(eventName)) return;  try {    const extUid = await getExtUid();    const sessionId = await getSessionId();    const countryCode = await getCountryLanguage();    const lang = await getBrowserLanguage();    const commonParams = getCommonHttpParams();    // ...build query string `r` from event/action/params...    if (r.trim().length > 0) {      let pageFields = {};      // `sendPageFields` is hardcoded false, so `pageFields` is ALWAYS populated      // with the live page URL, referrer, and title - there is no opt-out path.      const sendPageFields = false;      if (!sendPageFields) {        pageFields = {          dl: globalThis.document?.location?.href || "",   // page URL          dr: globalThis.document?.referrer || "",          // referrer          dt: globalThis.document?.title || ""              // page title        };      }      const screenRes = globalThis.screen ? `${globalThis.screen.width}x${globalThis.screen.height}` : "";      const beaconUrl = setURLQuery(GA_COLLECT_URL, {        v: "2", tid: GA_MEASUREMENT_ID, cid: extUid, sid: sessionId, sr: screenRes,        ...pageFields, ul: lang, sct: 1, seg: 1, _et: 100,        _p: randomStr(9, "0123456789"), _s: ++beaconCounter      });      if (navigator?.sendBeacon && navigator.sendBeacon(beaconUrl, r)) return true;    }  } catch (_) {}};
Where the page data goes
    • www.google-analytics.com

    Google's analytics collection endpoint; receives the page URL, title, referrer, and a persistent extension user ID on every navigation.

    • matomo.chnprice.com

    A Matomo analytics instance on a domain tied to the extension's operator; receives the same page URL and a separate user ID, unconditionally enabled.

Where it sends data

Destinations our analysis observed AiPrice(AliPrice) Search by Image for China Import Beta contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    AiPrice(AliPrice) Search by Image for China Import Beta sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • matomo.chnprice.com

    AiPrice(AliPrice) Search by Image for China Import Beta sends data to matomo.chnprice.com. No other extension we have analysed sends data here.

Updated 30 September 2026gghlgcihlfpfbibgaffggbmidpfejbbb