Is Alibaba Lens: Official Alibaba.com Image Search Tool for Wholesale Supply safe?

Medium risk

Alibaba Lens is medium risk. We observed Alibaba Lens send a GET to Alibaba's analytics host after extension interaction, carrying the current page URL, the CNA cookie identifier, event name, browser locale, extension version, and user-agent information.

alibaba-lensv1.3.4Chrome Web Store
45Risk
Who publishes it

alibaba-lens - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
alibaba-lens

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

gj.mmstat.com
Also called by 3 other listings, including 生意助手插件, WooCommerce AliExpress Dropshipping Extension
play.video.alibaba.com
Also called by 3 other listings, including 来搜, SuperAli
s.alicdn.com
Also called by 6 other listings, including 生意助手插件, SellersTracker, Zoof

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Alibaba Lens sends page URLs to Alibaba analytics

We observed Alibaba Lens send a GET to Alibaba's analytics host after extension interaction, carrying the current page URL, the CNA cookie identifier, event name, browser locale, extension version, and user-agent information.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install Alibaba Lens or use a Lens feature in the browser.

The background script calls the analytics routine on install, toolbar icon clicks, image capture, side-panel events, and context-menu searches.

The extension did this

The extension sends your current page URL and browser context to Alibaba analytics.

The same request includes a CNA cookie identifier and event metadata.

Captured request
GEThttps://gj.mmstat.com/sc.search.lens?cna=A8rZIoOGtD0CAS%2F2WPeBQXyP&gmkey=EXP&gokey=browserLocale%3Den-US%26pluginVersion%3D1.3.4%26ua%3DMozilla&_p_url=https%3A%2F%2Fwww.example.com%2F

200 OK

Fields sent in the analytics request
  • Current page URL
    https://www.example.com/

    Shows the page you were viewing when the extension event occurred.

  • Alibaba cookie identifier
    A8rZIoOGtD0CAS/2WPeBQXyP

    Lets the analytics endpoint connect repeated extension events to the same browser profile.

  • Event name
    EXP

    Shows which Lens feature or extension lifecycle event triggered the request.

  • Browser locale
    en-US

    Adds language and regional context to the browsing event.

  • Extension version
    1.3.4

    Identifies the installed Alibaba Lens release that generated the request.

  • Browser user agent
    Mozilla/5.0

    Adds browser and device details that can make events easier to correlate.

The code that does this

The background analytics function builds the request from the active tab URL

Readable version

Readable equivalent of the analytics sender

background.js
const readActiveTabUrl = () => new Promise(resolve => {  chrome.tabs.query({ active: true, currentWindow: true }, tabs => {    if (tabs.length === 0) {      resolve("");      return;    }    const tab = tabs[0];    resolve(tab.url || "");  });});const sendAnalytics = async (eventType, ...eventFields) => {  const gokeyParts = [];  const currentPageUrl = await readActiveTabUrl();  const browserLocale = navigator.language;  const fields = [    ...eventFields,    {      pluginLocale: (await getPluginLocale()).replace("_", "-"),      browserLocale,      pluginVersion: chrome.runtime.getManifest().version,      ua: navigator?.userAgent ?? ""    }  ];  let alreadyHasTimestamp = false;  for (const fieldGroup of fields) {    if (typeof fieldGroup === "object" && fieldGroup !== null) {      for (const [key, value] of Object.entries(fieldGroup)) {        if (key === "ts") alreadyHasTimestamp = true;        if (key === "imageAddress" && value?.length > 1000) continue;        gokeyParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);      }    } else if (typeof fieldGroup === "string") {      if (fieldGroup.includes("ts=")) alreadyHasTimestamp = true;      gokeyParts.push(fieldGroup);    }  }  const params = {    cna: await readCnaCookie(),    gmkey: eventType || "EXP",    gokey: `${gokeyParts.join("&")}${alreadyHasTimestamp ? "" : "&ts=" + +Date.now()}`,    _p_url: currentPageUrl  };  fetch(`https://gj.mmstat.com/sc.search.lens?${Object.keys(params).map(key => `${encodeURIComponent(key)}=${encodeURIComponent(params[key])}`).join("&")}`, {    credentials: "include"  });};
External destination receiving the browsing context
    • gj.mmstat.com

    Alibaba analytics endpoint that receives the current page URL, CNA cookie identifier, event name, locale, extension version, and browser user-agent details.

Updated 30 September 2026jjpbbahenfdgofabbgcnnfejgcigadpd