Is ASO - Toolbox by StoreMaven safe?

Medium risk

ASO - Toolbox by StoreMaven sends profile email and store-page analytics to StoreMaven's App Engine endpoint.

The extension reads the signed-in Chrome profile email and stores persistent toolbox user and session IDs. When the toolbox loads a store page or the user changes country, language, device, logo, or iframe settings, it sends analytics that include the email, IDs, app metadata, selected localization/device, and current store page URL.

Storemavenv3.0.0Chrome Web Store
45Risk
Who publishes it

Storemaven - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Storemaven
Declared legal entity
Storemaven
Registered contact
Yoav Ben Arie

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

ASO Toolbox by StoreMaven sends your Chrome email on every app listing view

Viewing a Play Store or App Store listing with ASO Toolbox installed reads your signed-in Chrome email and a persistent device ID, then sends both with the page URL to StoreMaven's analytics backend.

Not mentioned in the listing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a Google Play, App Store, or iTunes app listing page with the ASO Toolbox extension installed.

The content script runs automatically on any matching store listing URL.

The extension did this

The extension reads your signed-in Chrome account email and a persistent device ID, then sends both with the exact page URL to StoreMaven's analytics backend.

The same beacon fires again whenever you change the country, language, or device selector in the toolbox.

What the analytics beacon sends on every listing view
  • Your Chrome account email
    jane.doe@gmail.com (illustrative)

    If you're signed into Chrome, the email tied to your profile rides along with every beacon.

  • Persistent device ID
    b7e2a1f0-3c4d-4e9a-8b1f-6d2c9a7e0f31--1757374800000

    A UUID created once and reused forever, letting StoreMaven link every future listing view back to this browser.

  • Session ID
    4d9f1c2e-7a8b-4c3d-9e0f-1a2b3c4d5e6f--1757374800000

    A rotating ID that groups the beacons from roughly one hour of activity.

  • Store listing page URL
    https://play.google.com/store/apps/details?id=com.whatsapp

    The exact app page you're viewing, including the app's store ID.

  • App, country, language, device chosen
    com.whatsapp / US / en / android

    Which app you're previewing and which region, language, and device you selected in the toolbox.

Captured request
POSThttps://events-dot-mvns-creative-testing-prod.uc.r.appspot.com/aso_tool/v2?t=<RSA-OAEP-encrypted-timestamp>

sendBeacon (fire-and-forget, no response body observed)

Body
{  "action": "pageLoad",  "toolVersion": "3.0.0",  "email": "",  "uid": "b7e2a1f0-3c4d-4e9a-8b1f-6d2c9a7e0f31--1757374800000",  "appId": "com.whatsapp",  "appName": "WhatsApp Messenger",  "developerName": "WhatsApp LLC",  "language": "en",  "country": "us",  "context": "toolEngagement",  "storePlatform": "android",  "sessionId": "4d9f1c2e-7a8b-4c3d-9e0f-1a2b3c4d5e6f--1757374800000",  "device": "android",  "status": "success",  "url": "https://play.google.com/store/apps/details?id=com.whatsapp"}
The code that does this

Reading the profile email and building the analytics beacon

Readable version

Toolbox init: reads chrome.identity profile email (renamed)

main.552f6a4ba91a25744928.js
function initToolbox(ctx) {  var self = this;  ctx.patchState({ loadingState: LoadingState.LOADING });  ctx.dispatch(new SetToolboxLoading(true));  try {    // Reads the signed-in Chrome profile email. Granted by the    // "identity" + "identity.email" permissions in manifest.json.    chrome.identity.getProfileUserInfo(function (profile) {      return __awaiter(self, void 0, void 0, function* () {        const toolboxVersion = chrome.runtime.getManifest().version;        // Persistent device UUID, created once and reused forever        // (chrome.storage.sync key "sm_toolbox_uid").        const uid = yield this.localStorageService.getUserId();        const state = ctx.getState();        const appId = parseAppIdFromUrl(state.platform, state.url, state.urlParams);        const appSessionStatus = yield this.localStorageService.getAppSessionStatus(appId);        ctx.patchState({          toolboxVersion,          appId,          email: profile.email,   // Chrome account email, stored in app state          uid,          appSessionStatus,        });        this.setPlatformDevices(ctx, state.platform);        this.setPlatformLocalization(ctx, state.platform);        ctx.patchState({ loadingState: LoadingState.LOADED });      });    });  } catch (e) {    ctx.patchState({ loadingState: LoadingState.ERROR });  }}

Building and sending the beacon (renamed)

main.552f6a4ba91a25744928.js
function sendAnalytic(action, extra) {  // Per-request auth token: current timestamp, RSA-OAEP encrypted with a  // key bundled in the extension. Not user data, just a backend auth check.  var authToken = this.authService.getToolboxApiToken();  var url = this.API_URL + "/aso_tool/v2?t=" + encodeURIComponent(authToken);  this.getAnalyticsBaseFields().then(function (baseFields) {    // baseFields already carries { toolVersion, email, uid, appId, appName,    // developerName, language, country } from app state (see analyticsData    // selector, set by initToolbox).    var body = Object.assign({ action: action }, baseFields, extra);    navigator.sendBeacon(url, JSON.stringify(body)); // no consent prompt  });}function getAnalyticsBaseFields() {  return __awaiter(this, void 0, void 0, function* () {    const platform = this.store.selectSnapshot(ToolboxState.platform) === "android" ? "android" : "ios";    // Persistent session UUID, reused for 1 hour (chrome.storage.sync key    // "sm_toolbox_session_id").    const sessionId = yield this.localStorageService.getSessionId();    const eventTime = new Date();    const clientTime = toLocalTime(eventTime);    return Object.assign({}, this.store.selectSnapshot(ToolboxState.analyticsData), {      context: "toolEngagement",      storePlatform: platform,      clientTime,      eventTime,      status: "success",      sessionId,      device: this.store.selectSnapshot(ToolboxState.selectedDevice).type,      url: this.store.selectSnapshot(state => state.core.url), // the store listing page you're viewing    });  });}
Where the data goes
    • events-dot-mvns-creative-testing-prod.uc.r.appspot.com

    StoreMaven's own analytics backend (Google App Engine), the same company that publishes this extension. Receives email, device/session IDs, and page URL on every listing view.

What it can do

Permissions this extension asks for, as declared in version 3.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on serve-dot-mvns-creative-testing-prod.uc.r.appspot.com

    https://serve-dot-mvns-creative-testing-prod.uc.r.appspot.com/*

  • Read and change your data on events-dot-mvns-creative-testing-prod.uc.r.appspot.com

    https://events-dot-mvns-creative-testing-prod.uc.r.appspot.com/*

  • See the address and title of every tab you have open

    tabs

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed ASO - Toolbox by StoreMaven contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • events-dot-mvns-creative-testing-prod.uc.r.appspot.com

    ASO - Toolbox by StoreMaven sends data to events-dot-mvns-creative-testing-prod.uc.r.appspot.com. No other extension we have analysed sends data here.

Updated 30 September 2026nlgkbpcannbahibpdnonjpnndpeffhmh