Is Bitcashback safe?
Bitcashback uploads stored popup interaction logs with active-tab domains and the logged-in email to bitcashback.net.
Bitcashback records popup interaction events that include the current tab's domain, the logged-in user's email, timestamps, action details, and where the event happened. After the stored log is more than 24 hours old, the extension sends those actions to Bitcashback's extension API.
Who publishes itBCB SRL - no other listings under this identity
BCB SRL - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Browsing Domain and Email Uploaded to Bitcashback's Server After 24 Hours
Bitcashback's content script runs on every HTTPS page, not merchant sites only, batching popup interactions, uploading once the oldest is a day old.
Each entry has the site hostname, your account email, an action, location, timestamp.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You interact with Bitcashback's cashback popup on a store it recognizes, for example accepting its cookie notice or viewing an offer, at any point in the previous day.
The popup's script records the hostname of the tab you were on plus the email address logged into your bitcashback.net account, and queues this entry in local browser storage.
Once that entry is more than 24 hours old, the extension uploads it, hostname and email included, to Bitcashback's own server the next time you load any HTTPS page.
The check for an overdue entry runs from a content script active on every HTTPS site, not only merchant pages, so ordinary browsing can trigger the upload.
When a batch threshold is hit
The extension doesn't upload each popup interaction as it happens. Entries queue in local storage, and the whole queue is uploaded only once its oldest entry has been sitting there for more than 24 hours, checked on the next ordinary page load, not on a fixed schedule.
HTTP 200 with no distinguishing response body. The extension deletes its local queue once it receives this response.
- Content-Type
- application/json
{ "actions": [ { "action": "cookie_accept_required_view", "location": "bottom-popup", "timestamp": "2026-08-15T17:43:41.800Z", "domain": "www.libraccio.it", "email": "user@example.com" } ]}- Site hostnamewww.libraccio.it
The domain of whatever page you had open when you interacted with the popup. This is queued rather than sent immediately.
- Your Bitcashback emailuser@example.com
The email of the account you're logged into on bitcashback.net, attached to every queued entry so the upload ties back to your account.
- Action typecookie_accept_required_view
Which popup interaction this was, for example accepting a cookie notice or viewing a cashback offer.
- Timestamp2026-08-15T17:43:41.800Z
When the interaction happened. The extension uses this to decide when a queued entry is old enough to upload.
- bitcashback.net
Bitcashback's own backend, not a separate vendor. Receives queued uploads (hostname, email, action, timestamp) at /api/extension/user-actions once entries exceed 24 hours.
What it can do
Permissions this extension asks for, as declared in version 3.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Write to your clipboard
clipboardWrite
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed Bitcashback contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- bitcashback.net
Bitcashback sends data to bitcashback.net. No other extension we have analysed sends data here.