Is Amplitude Event Explorer safe?

High risk

Amplitude Event Explorer intercepts all outgoing browser requests to extract analytics payloads and can activate full DOM session recording on any page.

The extension's service worker reads the body of every outgoing web request across all websites to capture Amplitude analytics event data and API keys from request headers. When test mode is enabled by the user, the content script activates rrweb-based session recording at 100% sample rate, capturing DOM mutations, clicks, and form interactions and transmitting them to Amplitude's servers. The extension also reads Amplitude cookies on startup and can capture full DOM snapshots of any page and proxy them to app.amplitude.com.

Amplitudev1.8.1Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Session replay on all pages when test mode is enabled

Opening the popup, enabling Test Mode with session replay on, plus an Amplitude key entered, starts the content script, already in every tab, recording DOM mutations, clicks, form input via rrweb.

Batches go to Amplitude at 100% sample.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the extension popup, enter an Amplitude API key, and enable Test Mode with Session Replay turned on.

This sends a popup:setTestModeConfig message to every content script currently injected into open tabs.

The extension did this

The content script on the active tab immediately starts recording everything that happens on the page and sends it to Amplitude.

rrweb captures DOM mutations, clicks, scroll events, and text input at 100% sample rate; recordings are POSTed to api-sr.amplitude.com in gzip-encoded batches.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api-sr.amplitude.com/sessions/v2/track
during dynamic analysis captured 9 POST requests on en.wikipedia.org, bodies ranging from 189 B to 356 KB. Requests originated from source=cs (content script).
Headers
Content-Typeapplication/json
Body
{"version":1,"events":[<gzip-encoded rrweb event stream>]}
03EvidenceCODE COMPARE
The code that does this

Session replay plugin initialization at 100% sample rate

What it actually does
function activateSessionReplay(config) {
  if (!hI.instance) return;
  if (config.isEnabled && config.enableSessionReplay) {
    // sampleRate:1 = 100% of sessions recorded
    const replayPlugin = createSessionReplayPlugin({
      sampleRate: 1,
      storeType: 'memory',
      useWebWorker: true
    });
    hI.instance.add(replayPlugin);
    hI.sessionReplayPlugin = replayPlugin;
  } else if (hI.sessionReplayPlugin) {
    hI.instance.remove(hI.sessionReplayPlugin.name);
    hI.sessionReplayPlugin = null;
  }
}
04EvidenceFIELD TABLE
Data captured by rrweb and transmitted to Amplitude
FieldValueWhy it matters
DOM mutations
{"type":3,"data":{"source":2,"texts":[{"id":47,"value":"search query text"}]}}Every change to the page structure, text typed, elements added or removed, modal dialogs opening, is recorded as it happens.
Click and input events
{"type":3,"data":{"source":5,"id":102,"x":312,"y":448}}Mouse clicks and keyboard input on non-password form fields are captured, showing which UI elements you interact with.
Scroll position
{"type":3,"data":{"source":3,"x":0,"y":1240}}Scroll depth and viewport position are recorded throughout the session.
Page URL
https://en.wikipedia.org/wiki/Main_PageThe URL of the page being recorded is included in each session batch sent to Amplitude.
05EvidenceTHIRD PARTY LIST
Hosts receiving recorded session data
  • api-sr.amplitude.com

    Receives rrweb session replay batches. Run by Amplitude, Inc. (acquired by Confluent 2024). Data lands in the Amplitude project tied to the entered API key.

  • sr-client-cfg.amplitude.com

    Returns per-project privacy masking config (defaultMaskLevel, urlMaskLevels, capture_enabled, sample_rate). Masking depends on the operator's settings.

06EvidencePLAIN NOTE
Scope and activation caveat

Session replay only activates when a user with access to the extension popup explicitly enables it, enters a valid Amplitude API key, and toggles Session Replay on. The recording scope is limited to the tab where the content script is active at activation time; however because the content script is injected into all HTTP/S pages (`*://*/*`), any tab can become a recording target. Password, off-screen, file, email, and tel input fields are excluded by the `shouldTrackEventResolver` filter (inject.bundle.js line 60322). Privacy masking beyond that exclusion list depends on the remote config returned by sr-client-cfg.amplitude.com for the specific Amplitude project.

Data recipients

api.amplitude.comapi-sr.amplitude.comapi2.amplitude.comapp.amplitude.comsr-client-cfg.amplitude.com
Updated 17 September 2026acehfjhnmhbmgkedjmjlobpgdicnhkbp