Is Amazon Image Downloader - Images & Videos safe?

High risk

Amazon Image Downloader - Images & Videos is high risk. The extension sends your full URL, page title and referrer to Google Analytics for every website you open, not just Amazon or AliExpress. A persistent per-install ID ties these together. On by default; an options toggle can turn it off.…

aiprice1v5.1.6Chrome Web Store
72Risk
Who publishes it

aiprice1 - 16 other listings from the same operator, 1 of them carrying a finding

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Visiting any website fires an analytics beacon tied to a persistent ID

The extension sends your full URL, page title and referrer to Google Analytics for every website you open, not just Amazon or AliExpress.

A persistent per-install ID ties these together.

On by default; an options toggle can turn it off.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any website, not limited to Amazon, AliExpress, Alibaba or the other sites the extension's shopping tools cover.

The extension did this

The extension queues a page_view event with the page's full URL, title and referrer, tagged with a persistent id, and sends it via navigator.sendBeacon.

This runs on ordinary browsing, outside the extension's stated shopping features.

The code that does this

The auto-queued page_view event, seeded before the triggering event

Readable version

page-view auto-queue function

assets/js/chunk-common-e3b6d224.js
const j = async (_ = "", i = "", a = {}, t = {}) => {        const {          direct: o = !1        } = t, s = (_ = "", i = "", a = "", t, o = "") => {          const s = () => {            let _ = o;            const i = _ => (0, e.isPlainObject)(_) || (0, e.isArray)(_);            if ((0, e.isString)(o) && !(0, e.isEmpty)(o)) {              try {                _ = JSON.parse(o)              } catch (_) {}              if (!i(_)) try {                _ = (0, e.getAllURLQuery)(`/?${o}`)              } catch (_) {}            }            return i(_) || (_ = {}), _          };          (0, n.zj)({            category: _,            action: i,            name: a,            value: t,            details: s()          })        };        if (o) {          const e = await k(_, i, a);          s(i, a.event_action, a.event_name, a.event_value, a.event_label), !e && p && "event" === _ && w.set([_, i, a])        } else if (navigator?.sendBeacon) {          let e = globalThis[g] = globalThis[g] || [];          z || (z = !0, "page_view" !== _ && e.push(["page_view", "page_view", {            page_title: document.title,            page_location: document.location.href,            page_referrer: document.referrer          }])), e.push([_, i, a]), s(i, a.event_action, a.event_name, a.event_value, a.event_label)        } else !p && browser?.runtime?.sendMessage ? browser.runtime.sendMessage({          type: d.push2gaq,          payload: [_, i, a]        }) : p && "event" === _ && w.set([_, i, a])      }
What each page_view beacon carries
  • Page URL
    https://www.nytimes.com/2026/09/01/us/politics/example-article.html

    The exact address of the page you have open, sent for every site you visit.

  • Page title
    Example Article, Sept 1 2026

    The title of the page you have open.

  • Referrer
    https://www.google.com/

    The page you came from, showing part of your browsing path.

  • Client ID
    182734659.1739200000

    A stable ID tied to this install that lets Google Analytics link every page_view back to the same device across unrelated sites.

Third-party destinations
    • www.google-analytics.com

    Receives the page_view beacon (measurement id G-0P9YPW1GQ3) via Google Analytics 4, operated by Google LLC.

When this fires

Every 3 seconds

The event queue is flushed roughly every 3 seconds, and again when the tab is closed or navigated away from.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 5.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 5.1.6, which we have not unpacked yet.

  • Read and change your data on aliprice.com

    *://*.aliprice.com/*

  • Read and change your data on every site you visit

    <all_urls> and 1 more

  • Read and change your data on every secure site you visit

    https://*/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Schedule its own background tasks

    alarms

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

  • Show you desktop notifications

    notifications

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Updated 22 October 2026odmnpbmhgckabmbapcjhbfembfcleeje