Is 네이버 가격추적기 및 이미지 검색 safe?

Medium risk

네이버 가격추적기 및 이미지 검색 sends each page URL, title, and referrer to Google Analytics.

The extension's content script runs on all HTTP and HTTPS pages in all frames. When it initializes, it queues a Google Analytics page_view with the current URL, page title, referrer, browser language, screen size, and an installed-user or session identifier, then sends it to Google Analytics.

aiprice3v4.1.4Chrome Web Store
48Risk
Who publishes it

aiprice3 - 11 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aiprice3
Website
www.aiprice.com/information/index/page/contact

Same store account

11 other listings published from this account, 162k+ users between them. 3 of them carry a finding.

AliPrice100k+LowAiPrice(AliPrice) Search by image for AE20k+LowAutofill Taobao Tracking No. & Shipping Info10k+MediumSeller Price & Coupon Monitor9k+CleanPinduoduo Search by Image8k+Low%EC%BF%A0%ED%8C%A1-%EC%87%BC%ED%95%91-%EB%8F%84%EC%9A%B0%EB%AF%B86k+Low5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Content script sends every visited page's URL and title to Google Analytics

On every ordinary website you visit, this extension's content script sends the page's URL, title, and referrer to Google Analytics with a persistent client ID.

We observed this firing automatically with no user interaction.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any ordinary website with the extension enabled.

The content script matches every http and https page, including inside iframes.

The extension did this

The extension sends that page's URL, title, and referrer to Google Analytics.

The beacon fires automatically, with no click or extension UI interaction.

Captured request
POSThttps://www.google-analytics.com/g/collect?v=2&tid=G-YZP7L66RXP

HTTP 204 No Content, the standard Measurement Protocol acknowledgement.

Body
v=2&tid=G-YZP7L66RXP&cid=N182634529&sid=1725800000123&sr=1920x1080&ul=en-us&dl=https%3A%2F%2Fwww.ebay.com%2Fsch%2Fi.html%3F_nkw%3Dusb%2Bcable&dr=https%3A%2F%2Fwww.google.com%2F&dt=usb%20cable%20%7C%20eBay&sct=1&seg=1&_et=100&_p=847392615&_s=1&en=page_view
Fields sent in every page_view beacon
  • Page URL
    https://www.ebay.com/sch/i.html?_nkw=usb+cable

    The exact address of every page you visit, including any search terms in the URL.

  • Page title
    usb cable | eBay

    The page's title, often revealing what you searched for or read.

  • Referrer
    https://www.google.com/

    The page you arrived from, revealing part of your browsing path.

  • Client ID
    N182634529

    A persistent identifier tied to your install that lets Google Analytics link all your visits together.

  • Session ID
    1725800000123

    Groups the page views from one browsing session together.

The code that does this

Queued on every content-script load, flushed to Google Analytics on a timer

Readable version

Queue init (deobfuscated, chunk-common.js:7444-7454)

deobfuscated/assets/js/chunk-common.js
u = () => {  const e = () => {    globalThis[c] || (globalThis[c] = globalThis[c] || [], navigator?.sendBeacon && (globalThis[c].push(["page_view", "page_view", {      page_title: document.title,      page_location: document.location.href,      page_referrer: document.referrer    }]), setInterval((() => {      T([...globalThis[c]]), globalThis[c] = []    }), 3e3), window.addEventListener("beforeunload", (() => {      T([...globalThis[c]]), globalThis[c] = []    }))))  };  e()}, t["default"] = u

Beacon send (deobfuscated, chunk-common.js:7396-7410)

deobfuscated/assets/js/chunk-common.js
c.length > 0 && navigator.sendBeacon((0, r.OKO)(n, {  v: "2",  tid: s,  cid: i,  sid: o,  sr: `${globalThis.screen.width}x${globalThis.screen.height}`,  dl: document.location.href,  dr: document.referrer,  dt: document.title,  ul: p,  sct: 1,  seg: 1,  _et: 100,  _p: (0, r.vxQ)(9, "0123456789"),  _s: ++A}), c)
Where the beacon lands
    • www.google-analytics.com

    Google's analytics endpoint. Receives the page URL, title, referrer, and a persistent client ID from every site the beacon fires on, under the extension's own GA4 property.

What it can do

Permissions this extension asks for, as declared in version 4.1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • Schedule its own background tasks

    alarms

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

  • Show you desktop notifications

    notifications

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed 네이버 가격추적기 및 이미지 검색 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    네이버 가격추적기 및 이미지 검색 sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026bjekehokhpkicboifnoocieebcdbdmne