Is AMALYZE - for Amazon Sellers and Vendors safe?

Medium risk

AMALYZE sends hashed Chrome profile email, profile ID, and an extension UUID to falcon.amalyze.com during heartbeats.

On background startup, AMALYZE starts a Falcon heartbeat and repeats it every 180 minutes. Each status request to falcon.amalyze.com includes headers containing the hashed Chrome profile email, Chrome profile ID, a one-time token derived from that ID, and a persisted extension UUID.

AMALYZE Inc.v2.9.2Chrome Web Store
45Risk
Who publishes it

AMALYZE Inc. - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AMALYZE Inc.
Declared legal entity
AMALYZE Inc.
Registered address
66W W Flagler St STE 900-2299, Miami, FL 33130-1807, US
Registered contact
Michael Gabrielides

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

sellercentral.amazon.cn
Also called by 6 other listings, including Online Seller Addon

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AMALYZE sends your Google account ID and a device ID to Amalyze every 3 hours

AMALYZE sends the email and ID of your signed-in Google account to Amalyze's server on install, and again every 3 hours, along with a rotating one-time code and a permanent device ID, with no consent prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the AMALYZE extension, or Chrome restarts its background service worker.

No page visit, click, or Amazon page load is needed.

The extension did this

The extension reads your signed-in Google account's email and ID and sends both to Amalyze's server, with a rotating one-time code and a permanent device ID.

This happens immediately on startup and repeats every 3 hours without a consent prompt.

Fields sent in every heartbeat request
  • Your Google account email
    1df66fbb427ff7e64ac46af29cc74b71 (illustrative, md5 of an example address)

    Sent as an MD5 hash rather than plaintext, but the hash is not salted, so it can be matched back to your email by hashing common addresses.

  • Your Google account ID
    107834521098765432109 (illustrative)

    Your numeric Google account identifier, sent unhashed and in plaintext.

  • One-time passcode
    482913 (illustrative, rotates every 30s)

    A 6-digit code derived from your account ID, refreshed every 30 seconds. Proves the request came from a client that knows your account ID.

  • Extension install ID
    a1b2c3d4-5678-90ab-cdef-1234567890ab (illustrative)

    A UUID generated once and stored permanently on your device, letting Amalyze recognize this browser across every future heartbeat.

When this fires

Every 3 hours

Fires immediately when the extension starts, then repeats every 3 hours for as long as the extension stays enabled.

Where your identifiers go
    • falcon.amalyze.com

    Receives your hashed email, account ID, one-time code, and device UUID on every heartbeat. Owned by Amalyze, the extension's own publisher.

What it can do

Permissions this extension asks for, as declared in version 2.9.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on amazon.de

    https://*.amazon.de/*

  • Read and change your data on amazon.co.uk

    https://*.amazon.co.uk/*

  • Read and change your data on amazon.it

    https://*.amazon.it/*

  • Read and change your data on amazon.fr

    https://*.amazon.fr/*

  • Read and change your data on amazon.es

    https://*.amazon.es/*

  • Read and change your data on amazon.nl

    https://*.amazon.nl/*

  • Read and change your data on amazon.com.tr

    https://*.amazon.com.tr/*

  • Read and change your data on amazon.com

    https://*.amazon.com/*

  • Read and change your data on amazon.ca

    https://*.amazon.ca/*

  • Read and change your data on amazon.com.mx

    https://*.amazon.com.mx/*

  • Read and change your data on amazon.com.br

    https://*.amazon.com.br/*

  • Read and change your data on amazon.co.jp

    https://*.amazon.co.jp/*

  • Read and change your data on amazon.com.au

    https://*.amazon.com.au/*

  • Read and change your data on amazon.in

    https://*.amazon.in/*

  • Read and change your data on amazon.cn

    https://*.amazon.cn/*

  • Read and change your data on amalyze.com

    https://*.amalyze.com/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

  • Run its own code inside the pages you visit

    scripting

  • See the address and title of every tab you have open

    tabs

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed AMALYZE contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • falcon.amalyze.com

    AMALYZE sends data to falcon.amalyze.com. No other extension we have analysed sends data here.

Updated 30 September 2026jbfijfdmeapilpakkljjmkfjlomhinnm