Is Т-Промокоды - купоны и скидки онлайн safe?

Medium risk

T-Promokody sends a list of all your installed extensions to Google Analytics when it is installed.

When the extension is installed, it reads the id, name and enabled state of every extension in your browser and includes that list in an analytics event. The event is posted to Google Analytics using a measurement ID and API secret built into the code. This is on by default in Chrome and Edge.

v1.1.4.8Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

T-Promokody sends your installed extension list to Google Analytics on install

Code analysis shows that on install the extension reads the id, name and enabled state of every installed extension and posts that list to Google Analytics, unless analytics is switched off.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Static analysis
What actually happens
You did this

You install the extension with default settings.

The extension did this

It reads every installed extension's id, name and enabled state and posts the list to Google Analytics.

The post goes to www.google-analytics.com/mp/collect.

The code that does this

Install handler collects the extension list; sender builds the GA4 request

Readable version

Parameter whitelist in F() includes the list

bg/bg.js
null != t && t.installed_extensions && (n.installed_extensions = null == t ? void 0 : t.installed_extensions)
Per-extension record placed in the event
  • Extension ID
    cjpalhdlnbpafiamejdnhcphjbkeiagm

    Identifies each other extension installed in your browser.

  • Extension name
    uBlock Origin

    Shows which tools, wallets or services you use.

  • Enabled state
    true

    Shows whether each extension is currently turned on.

Where the list is sent
    • www.google-analytics.com

    GA4 Measurement Protocol endpoint; receives the event under measurement ID G-WWCQKXGEFG.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Т-Промокоды - купоны и скидки онлайн contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Т-Промокоды - купоны и скидки онлайн sends data to www.google-analytics.com. A widely used service: 372 other extensions we have analysed send data here.

Updated 15 October 2026akfpfknibfabmgflodhhemljeannmaif