Is Black Friday de Verdade safe?

Medium risk

Black Friday de Verdade sends matched checkout-page URLs and extracted page values to its backend.

When a merchant page matches its remote store-flow configuration, the extension records the current URL and reads configured page values such as DOM text, form input, script data, or page variables. It base64-encodes the flow and values and posts them to the Black Friday de Verdade backend.

bfverdade.cuponsv12.56.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Black Friday de Verdade reports your checkout page visits to its coupon backend

When a page matches a merchant list the extension's server controls, it sends that checkout page's URL to its own backend along with a persistent tracking ID.

We observed this live on two merchant checkout pages during dynamic analysis.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You load a checkout confirmation page on a merchant site the extension's remote configuration currently targets, such as Netshoes or Centauro.

The extension's content script runs on every http and https page you visit, waiting for a match.

The extension did this

The extension records that page's URL and reports it to its own backend, tagged with a tracking ID that persists across browsing sessions.

The report is base64 encoded and posted to buscacupons.blackfridaydeverdade.com.br/actions/post/flow.

Fields in the actions/post/flow report
  • Checkout page URL
    https://www.netshoes.com.br/checkout/payment/confirm/1234567

    Identifies the specific merchant page you visited, including the order confirmation path.

  • Persistent tracking ID
    018-9d6b3dc4-af37-c398-5c1a-637754ad8f84

    Lets the backend tie every report back to the same browser installation over time.

  • Matched store ID
    5

    Tells the backend which remote flow rule matched and triggered the report.

  • Extension/browser version tags
    isxversion=6.7.0, isxbrowser=chromium

    Lets the backend segment reports by extension build and browser.

Captured request
POSThttps://buscacupons.blackfridaydeverdade.com.br/actions/post/flow
Headers
Content-Type
application/x-www-form-urlencoded
Body
store_id=5&flow=W3sidHMiOjE3ODg4NzYyMDEsInR5cGUiOiJsb2MiLCJ2YWx1ZSI6Imh0dHBzOi8vd3d3Lm5ldHNob2VzLmNvbS5ici9jaGVja291dC9wYXltZW50L2NvbmZpcm0vMTIzNDU2NyJ9XQ%3D%3D&values=e30%3D&localid=018-9d6b3dc4-af37-c398-5c1a-637754ad8f84&isxmode=production&isxversion=6.7.0&isxbrowser=chromium
Why you can't catch this in DevTools

The flow field is not human readable on the wire. It is a base64 string that decodes to a JSON record of the page you visited and when.

Decoded value
[  {    "ts": 1788876201,    "type": "loc",    "value": "https://www.netshoes.com.br/checkout/payment/confirm/1234567"  }]
The code that does this

How a page visit becomes a report

Readable version

Remote flow rule check, renamed

background.js:427-432
const isFlowActiveForStore = (storeId) => __awaiter(void 0, void 0, void 0, function* () {    const storeConfig = yield getStoreConfig(storeId);    // storeConfig.flow.ativo is a boolean the server sets per store    return storeConfig?.flow?.ativo;});

Content script loads the page-reader when a rule matches, renamed

index.js
useEffect(() => {  // checkoutPage is set once the current URL matches a live remote flow rule  const hasActiveStores = storeList?.length;  const matchesCheckout = checkoutPage?.idloja;  if (hasActiveStores && matchesCheckout && !alreadyInjected && !location.host.endsWith('dropbox.com')) {    loadScript(resolveUrl('/3rdparty/sizzle.js'));    loadScript(resolveUrl('/injection/injection.js')); // reads the matched page    setInjected(true);  }}, [storeList, alreadyInjected]);

Queue and send the report, renamed

background.js:411-425
onMessage('bg_sendFlow', (msg, sender, sendResponse) => __awaiter(void 0, void 0, void 0, function* () {  const { storeId, scrapedValues } = msg;  const result = yield sendFlowReport(storeId, scrapedValues);  sendResponse({ status: true, result });}));const sendFlowReport = (storeId, scrapedValues) => __awaiter(void 0, void 0, void 0, function* () {  const flowQueue = getFlowQueue(storeId);  const queuedEvents = yield flowQueue.getAll(); // [{ts, type:'loc', value:<url>}, ...]  const requestBody = {    store_id: storeId,    flow: btoa(JSON.stringify(queuedEvents)),      // page-visit history, base64    values: btoa(JSON.stringify(scrapedValues))    // selector-scraped page values, base64  };  // postToBackend also appends localid, isxmode, isxversion, isxbrowser to every request  return yield BackendClient.postToBackend('actions/post/flow', requestBody, { ttl: FLOW_CACHE_TTL });});
Where the report goes
    • buscacupons.blackfridaydeverdade.com.br

    The extension's own coupon and price-comparison backend. Also receives this checkout-page-visit report tagged with a persistent tracking ID.

What it can do

Permissions this extension asks for, as declared in version 12.56.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on buscacupons.blackfridaydeverdade.com.br

    https://buscacupons.blackfridaydeverdade.com.br/**/*

  • Sign you in with your Google account

    identity

Where it sends data

Destinations our analysis observed Black Friday de Verdade contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • buscacupons.blackfridaydeverdade.com.br

    Black Friday de Verdade sends data to buscacupons.blackfridaydeverdade.com.br. No other extension we have analysed sends data here.

Updated 30 September 2026gofbkgfgjgkmphjcfgbmdelmamlnhcnh