Is Alibaba Search by image safe?

Medium risk

Alibaba Search by image is medium risk. Opening a top-level page, Alibaba Search by image can send the page URL, referrer, browser details, and a persistent user ID to `api.asbipartnerdb.com/check`. Dynamic analysis confirmed this POST for a Reddit navigation.

alibabasearchbyimagev1.4.19Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Browsing URLs sent to ASBI partner API

Opening a top-level page, Alibaba Search by image can send the page URL, referrer, browser details, and a persistent user ID to `api.asbipartnerdb.com/check`.

Dynamic analysis confirmed this POST for a Reddit navigation.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a top-level page in the browser.

The code path is tied to normal page navigation, not only to image-search clicks.

The extension did this

The extension builds a browsing report and posts it to `api.asbipartnerdb.com/check`.

The report includes the page URL, site domain, referring site, browser details, and a stored extension user ID.

Captured request
POSThttps://api.asbipartnerdb.com/check

Dynamic analysis recorded request body fields for a Reddit navigation: uri included a reddit.com URL with query parameters, domain was www.reddit.com, referer was https://www.reddit.com, and locale, user_agent, and platform were present.

Headers
Content-Type
application/json
Fields assembled for the partner API request
  • Page URL
    https://www.reddit.com/?solution=<redacted>&token=<redacted> (observed parameter names; values not republished)

    Shows the exact page you opened, including path and query-string fields when they are present.

  • Site domain
    www.reddit.com (observed during dynamic analysis)

    Records which website you visited even when the full path is not needed.

  • Referring site
    https://www.reddit.com (observed during dynamic analysis)

    Adds the site context associated with the navigation when the browser provides it.

  • Browser profile
    locale, user_agent, platform, and vendor fields were recorded during dynamic analysis

    Adds details about your browser and device environment to the browsing report.

  • Extension user ID
    9f2f6f88-1f44-4fd2-8f91-2a7a2c5d9e10 (illustrative UUID generated by the extension)

    Links separate reports from the same extension install over time.

The code that does this

The background listener that posts navigation details

Readable version

Readable equivalent of the stored ID setup

background.js
let userId = "";(function initializeUserIdStore() {  const request = indexedDB.open("ASBIPARTNERDB", 2);  request.onupgradeneeded = (event) => {    event.target.result      .createObjectStore("ASBIuids", { autoIncrement: true })      .createIndex("uuid", "uuid", { unique: true });  };  request.onerror = () => {};  request.onsuccess = (event) => {    const db = event.target.result;    const tx = db.transaction("ASBIuids", "readonly");    const getRequest = tx.objectStore("ASBIuids").get(1);    getRequest.onsuccess = (event) => {      if (!event.target.result) {        const uuid = self.crypto.randomUUID();        const writeTx = db.transaction("ASBIuids", "readwrite");        writeTx.objectStore("ASBIuids").put({ uuid });        writeTx.oncomplete = function () {          db.close();        };      }    };    getRequest.onerror = () => {};    tx.oncomplete = function () {      db.close();    };  };})();indexedDB.open("ASBIPARTNERDB", 2).onsuccess = (event) => {  const db = event.target.result;  const tx = db.transaction("ASBIuids", "readonly");  const getRequest = tx.objectStore("ASBIuids").get(1);  getRequest.onsuccess = (event) => {    if (event.target.result) {      userId = event.target.result.uuid;    }  };  getRequest.onerror = () => {};  tx.oncomplete = function () {    db.close();  };};

Readable equivalent of the navigation POST

background.js
chrome.webRequest.onBeforeSendHeaders.addListener(  function onBeforeSendHeaders(details) {    if (      details.documentId ||      details.method !== "GET" ||      details.parentFrameId !== -1 ||      details.type !== "main_frame"    ) {      return;    }    const visitedUrl = new URL(details.url);    async function postNavigation(details, visitedUrl, endpoint = "", userId = "") {      const body = {        timestamp: Date().toLocaleString(),        uri: details.url,        domain: visitedUrl.hostname,        title: "",        referer: details.initiator,        locale: navigator.language,        user_agent: navigator.userAgent,        platform: navigator.platform,        vendor: navigator.vendor,        user_id: userId,      };      return (        await fetch(endpoint, {          method: "POST",          headers: { "Content-Type": "application/json" },          body: JSON.stringify(body),        })      ).json();    }    postNavigation(      details,      visitedUrl,      "https://api.asbipartnerdb.com/check",      userId,    ).then((response) => {      if (        response &&        response.match &&        response.partner &&        response.partner.startdate &&        response.partner.enddate &&        response.partner.partnertype === "AFFILIATE"      ) {        const now = new Date();        const startParts = response.partner.startdate.split("-");        const startDate = new Date(startParts[0], startParts[1], startParts[2]);        const endParts = response.partner.enddate.split("-");        const endDate = new Date(endParts[0], endParts[1], endParts[2]);        if (startDate < now && now < endDate && response.partner.regex) {          const urlFilter = "||" + visitedUrl.hostname;          chrome.declarativeNetRequest.updateSessionRules(            {              addRules: [                {                  id: 4,                  priority: 1,                  action: {                    type: "redirect",                    redirect: { regexSubstitution: response.partner.regex },                  },                  condition: {                    urlFilter,                    resourceTypes: ["main_frame"],                  },                },              ],              removeRuleIds: [id],            },            function () {},          );        }      }    });  },  { urls: ["<all_urls>"] },);
Remote destination involved in this claim
    • api.asbipartnerdb.com

    Receives the navigation report posted by the background service worker.

What it can do

Permissions this extension asks for, as declared in version 1.4.19. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Watch every request your browser makes

    webRequest

  • See the address and title of every tab you have open

    tabs

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 21 September 2026begnkfeikebdelojdklgfkbhbeboilne