Is Area360 - Property Data safe?

High risk

Area360 - Property Data is high risk. A content script runs on every HTTPS page, not just Rightmove and Zoopla, scanning for UK postcodes and coordinates. When Area360's remote config enables collection for that site, the page URL, title, and matches are sent to Area360.

Area360v2.0.2Chrome Web Store
73Risk
Who publishes it

Area360 - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Area360
Website
area360.uk/contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Rightmove/Zoopla extension scans every HTTPS page you visit for UK postcodes

A content script runs on every HTTPS page, not just Rightmove and Zoopla, scanning for UK postcodes and coordinates.

When Area360's remote config enables collection for that site, the page URL, title, and matches are sent to Area360.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Loads any HTTPS page, such as a property listing on a site other than Rightmove or Zoopla.

The extension's content script runs on every site (https://*/*), not just the two named in its listing.

The extension did this

The extension scans the page for UK postcodes and coordinates and sends them, with the page URL and title, to Area360.

This only happens once Area360's remote config has turned collection on for that domain.

What gets uploaded from the page you're viewing
  • Page address you're viewing
    https://www.onthemarket.com/details/17541470/

    Ties every scan to the exact page, and on remote-config-enabled sites, to a specific listing.

  • Site domain
    onthemarket.com

    Groups your visits by which property portal or website you use, not just the two the listing names.

  • Page title
    3 bed semi-detached house for sale in Mildenhall, IP28 (illustrative)

    Often names the address, price, or area of the listing you're viewing.

  • UK postcodes found on the page

    Extracted from the page's HTML and URL, up to 14 unique postcodes per page, pinpointing properties or areas you viewed.

  • Map coordinates found on the page
    52.301,0.499 (illustrative)

    Extracted latitude/longitude pairs, up to 14 unique per page, when the page embeds a map instead of a postcode.

Captured request
POSThttps://api.area360.uk/api/public/extension/location-search

200 OK. The response, observed during dynamic analysis, returned total_results: 2 and a sidebar_html block naming postcodes E14 7HG and IP28 7DE, each with per-postcode crime, deprivation, and income data plus ext_uuid/ext_iid tracking parameters. IP28 7DE is the letting agent's address printed on the visited listing page, which the server could only have produced from data the extension extracted and uploaded.

Headers
X-Enc
2
content-type
application/json;charset=UTF-8
X-Client-Version
2.0.6
The code that does this

Content script matches every HTTPS site; the listing names only two

Readable version

Content script registration

location-search-listener.b4876d2c.js
let l = {  matches: ["https://*/*"],  run_at: "document_end",  all_frames: !1};

isLocationSearchEnabled(url) - per-domain remote kill switch

location-search-listener.b4876d2c.js
async function l(e, t = null) {  let r = await (0, o.default).isEnabled("location_search");  if (!r) return (0, u.default).warn("location_search is disabled"), !1;  let i = await (0, o.default).getValue("location_search_config", null);  if (t && (i = t), !i) return (0, u.default).warn("No location search config found"), !1;  let n = e.hostname.replace("www.", ""),    s = e.href.substring(e.origin.length),    a = i[n];  if (!a) return (0, u.default).warn(`No location search config found for domain ${n}`), !1;  for (let e of a.patterns)    if (s.match(e)) return (0, u.default).info(`Location search config enabled for path ${s}, pattern: ${e}`), !0;  return (0, u.default).info(`No location search config found for path ${s}, patterns: ${a.patterns.join(", ")}`), !1}
Where the scanned page data ends up
    • api.area360.uk

    Receives the page URL, title, and extracted UK postcodes/coordinates from every HTTPS site the remote config enables. Run by Area360, the extension's own developer.

    • fs.area360.uk

    Serves the GrowthBook remote config that turns page-scanning on or off per domain, for around 130 property-portal domains observed live. Also run by Area360.

What it can do

Permissions this extension asks for, as declared in version 2.0.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 2.0.2, which we have not unpacked yet.

  • Read and change your data on every site you visit

    *://*/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Updated 30 September 2026fmkcdnhkhfnbaomihadamoendclmjglb