Is Amazon Image Downloader - Images & Videos safe?
Amazon Image Downloader - Images & Videos is high risk. The extension sends your full URL, page title and referrer to Google Analytics for every website you open, not just Amazon or AliExpress. A persistent per-install ID ties these together. On by default; an options toggle can turn it off.…
Who publishes itaiprice1 - 16 other listings from the same operator, 1 of them carrying a finding
aiprice1 - 16 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
16 other listings published from this account, 7k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Visiting any website fires an analytics beacon tied to a persistent ID
The extension sends your full URL, page title and referrer to Google Analytics for every website you open, not just Amazon or AliExpress.
A persistent per-install ID ties these together.
On by default; an options toggle can turn it off.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open any website, not limited to Amazon, AliExpress, Alibaba or the other sites the extension's shopping tools cover.
The extension queues a page_view event with the page's full URL, title and referrer, tagged with a persistent id, and sends it via navigator.sendBeacon.
This runs on ordinary browsing, outside the extension's stated shopping features.
The auto-queued page_view event, seeded before the triggering event
page-view auto-queue function
assets/js/chunk-common-e3b6d224.jsconst j = async (_ = "", i = "", a = {}, t = {}) => { const { direct: o = !1 } = t, s = (_ = "", i = "", a = "", t, o = "") => { const s = () => { let _ = o; const i = _ => (0, e.isPlainObject)(_) || (0, e.isArray)(_); if ((0, e.isString)(o) && !(0, e.isEmpty)(o)) { try { _ = JSON.parse(o) } catch (_) {} if (!i(_)) try { _ = (0, e.getAllURLQuery)(`/?${o}`) } catch (_) {} } return i(_) || (_ = {}), _ }; (0, n.zj)({ category: _, action: i, name: a, value: t, details: s() }) }; if (o) { const e = await k(_, i, a); s(i, a.event_action, a.event_name, a.event_value, a.event_label), !e && p && "event" === _ && w.set([_, i, a]) } else if (navigator?.sendBeacon) { let e = globalThis[g] = globalThis[g] || []; z || (z = !0, "page_view" !== _ && e.push(["page_view", "page_view", { page_title: document.title, page_location: document.location.href, page_referrer: document.referrer }])), e.push([_, i, a]), s(i, a.event_action, a.event_name, a.event_value, a.event_label) } else !p && browser?.runtime?.sendMessage ? browser.runtime.sendMessage({ type: d.push2gaq, payload: [_, i, a] }) : p && "event" === _ && w.set([_, i, a]) }- Page URLhttps://www.nytimes.com/2026/09/01/us/politics/example-article.html
The exact address of the page you have open, sent for every site you visit.
- Page titleExample Article, Sept 1 2026
The title of the page you have open.
- Referrerhttps://www.google.com/
The page you came from, showing part of your browsing path.
- Client ID182734659.1739200000
A stable ID tied to this install that lets Google Analytics link every page_view back to the same device across unrelated sites.
- www.google-analytics.com
Receives the page_view beacon (measurement id G-0P9YPW1GQ3) via Google Analytics 4, operated by Google LLC.
Every 3 seconds
The event queue is flushed roughly every 3 seconds, and again when the tab is closed or navigated away from.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 5.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 5.1.6, which we have not unpacked yet.
Read and change your data on aliprice.com
*://*.aliprice.com/*
Read and change your data on every site you visit
<all_urls> and 1 more
Read and change your data on every secure site you visit
https://*/*
Act on the current tab, but only after you click the extension
activeTab
Schedule its own background tasks
alarms
Add items to the right-click menu
contextMenus
Read and change cookies, including the ones that keep you signed in
cookies
Block and redirect the requests your browser makes
declarativeNetRequest
See which of your requests its blocking rules matched
declarativeNetRequestFeedback
Show you desktop notifications
notifications
Run its own code inside the pages you visit
scripting
Store data in your browser
storage