Is Banggood Price Tracker safe?

Low risk

Banggood Price Tracker's content script accepts commands from a spoofed sender field instead of verifying the message's real origin.

On shopping sites like AliExpress, Amazon, Banggood, Gearbest, JD, Joybuy, and Lazada, the extension's content script listens for window.postMessage events and is meant to only act on ones from aiprice.com. Its check also passes any message whose payload contains a hardcoded sender label, a value any script on the page can set itself, so a script running on the same page (not just aiprice.com) can trigger the extension's internal message handlers, including a flow that opens AliPrice's order-forwarding UI and handlers that read page properties back to the extension.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

aiprice2v3.0.3Chrome Web Store
18Risk
Who publishes it

aiprice2 - 14 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on aiprice.com

    *://*.aiprice.com/*

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/*

  • Read and change your data on aliprice.com

    *://*.aliprice.com/*

  • Read and change your data on amazon.com

    *://*.amazon.com/*

  • Read and change your data on banggood.com

    *://*.banggood.com/*

  • Read and change your data on gearbest.com

    *://*.gearbest.com/*

  • Read and change your data on jd.id

    *://*.jd.id/*

  • Read and change your data on jd.ru

    *://*.jd.ru/*

  • Read and change your data on joybuy.com

    *://*.joybuy.com/*

  • Read and change your data on joybuy.es

    *://*.joybuy.es/*

  • Read and change your data on lazada.co.id

    *://*.lazada.co.id/*

  • Read and change your data on lazada.co.th

    *://*.lazada.co.th/*

  • Read and change your data on lazada.com.my

    *://*.lazada.com.my/*

  • Read and change your data on lazada.com.ph

    *://*.lazada.com.ph/*

  • Read and change your data on lazada.sg

    *://*.lazada.sg/*

  • Read and change your data on lazada.vn

    *://*.lazada.vn/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Schedule its own background tasks

    alarms

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Show you desktop notifications

    notifications

  • Store data in your browser

    storage

  • Read how much memory your computer has

    system.memory

Updated 30 September 2026gpibjcffchpcklhagnijajmgnndnokhn