Is Banggood Price Tracker safe?
Banggood Price Tracker's content script accepts commands from a spoofed sender field instead of verifying the message's real origin.
On shopping sites like AliExpress, Amazon, Banggood, Gearbest, JD, Joybuy, and Lazada, the extension's content script listens for window.postMessage events and is meant to only act on ones from aiprice.com. Its check also passes any message whose payload contains a hardcoded sender label, a value any script on the page can set itself, so a script running on the same page (not just aiprice.com) can trigger the extension's internal message handlers, including a flow that opens AliPrice's order-forwarding UI and handlers that read page properties back to the extension.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itaiprice2 - 14 other listings from the same operator, 1 of them carrying a finding
aiprice2 - 14 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
14 other listings published from this account, 489k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on aiprice.com
*://*.aiprice.com/*
Read and change your data on aliexpress.com
*://*.aliexpress.com/*
Read and change your data on aliprice.com
*://*.aliprice.com/*
Read and change your data on amazon.com
*://*.amazon.com/*
Read and change your data on banggood.com
*://*.banggood.com/*
Read and change your data on gearbest.com
*://*.gearbest.com/*
Read and change your data on jd.id
*://*.jd.id/*
Read and change your data on jd.ru
*://*.jd.ru/*
Read and change your data on joybuy.com
*://*.joybuy.com/*
Read and change your data on joybuy.es
*://*.joybuy.es/*
Read and change your data on lazada.co.id
*://*.lazada.co.id/*
Read and change your data on lazada.co.th
*://*.lazada.co.th/*
Read and change your data on lazada.com.my
*://*.lazada.com.my/*
Read and change your data on lazada.com.ph
*://*.lazada.com.ph/*
Read and change your data on lazada.sg
*://*.lazada.sg/*
Read and change your data on lazada.vn
*://*.lazada.vn/*
Act on the current tab, but only after you click the extension
activeTab
Schedule its own background tasks
alarms
Add items to the right-click menu
contextMenus
Read and change cookies, including the ones that keep you signed in
cookies
See, disable and uninstall your other extensions, including your security ones
management
Show you desktop notifications
notifications
Store data in your browser
storage
Read how much memory your computer has
system.memory