Is Bambuser One-to-One safe?
Bambuser One-to-One removes X-Frame-Options/CSP headers and rewrites consent cookies on merchant sites named in Bambuser's remote config.
The extension powers Bambuser's live-shopping agent dashboard and only accepts commands from lcx.bambuser.com / lcx-eu.bambuser.com. When an agent starts a session it fetches a list of merchant origins from Bambuser's backend and, for those origins, removes X-Frame-Options and Content-Security-Policy response headers (via declarativeNetRequest) so they can be embedded in a co-browse frame. It also injects a MAIN-world script that rewrites configured 'consent' cookies to SameSite=None;Secure and can fetch a merchant page's HTML back to the dashboard. The exact origins, CSP values, and cookie names are not hardcoded - they come entirely from Bambuser's org-settings endpoint.
Who publishes itBambuser - no other listings under this identity
Bambuser - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Bambuser One-to-One contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- lcx-eu.bambuser.com
Bambuser One-to-One sends data to lcx-eu.bambuser.com. No other extension we have analyzed sends data here.
- lcx.bambuser.com
Bambuser One-to-One sends data to lcx.bambuser.com. No other extension we have analyzed sends data here.
- svc-prod-eu.liveshopping.bambuser.com
Bambuser One-to-One sends data to svc-prod-eu.liveshopping.bambuser.com. No other extension we have analyzed sends data here.
- svc-prod-us.liveshopping.bambuser.com
Bambuser One-to-One sends data to svc-prod-us.liveshopping.bambuser.com. No other extension we have analyzed sends data here.