Is Buscapé safe?

Medium risk

Buscapé is medium risk. Testing captured POSTs showing Buscape fingerprints the browser with FingerprintJS v3 on install, using the hash as a tracking ID. Stored as `anonymousId`, sent as `client_id` in GA4 events and `fingerprint` in API calls, no consent needed.

Banco Pan S.Av10.22.1Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Browser fingerprint used as persistent cross-session analytics ID

Testing captured POSTs showing Buscape fingerprints the browser with FingerprintJS v3 on install, using the hash as a tracking ID.

Stored as `anonymousId`, sent as `client_id` in GA4 events and `fingerprint` in API calls, no consent needed.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Extension installed in Chrome

The extension did this

FingerprintJS singleton derives a browser fingerprint hash and stores it as a permanent analytics identifier

The background service worker instantiates the FingerprintJS singleton at startup, which calls `l.load().get()` to hash browser attributes into a `visitorId` string. This value is saved as `anonymousId` in chrome.storage.local and attached to all subsequent outbound events.

Captured request
POSThttps://www.google-analytics.com/mp/collect?api_secret=<redacted>&measurement_id=G-NE7Z23Q5SN
Headers
Content-Type
application/json
Body
{  "client_id": "d0b3d6c3a637f19e401bc85a8baa14d3",  "events": [    {      "name": "install",      "params": {        "session_id": "session_id_1716900000000",        "engagement_time_msec": 100,        "versao": "version_10.22.1",        "origin": "plugin",        "datetime": "datetime_2024-05-28T14:00:00.000Z",        "type": "install"      }    }  ]}
Third-party destinations
    • www.google-analytics.com

    Google Analytics 4 Measurement Protocol, receives install, click, page view, and purchase events with the fingerprint hash as `client_id`

    • api-v1.zoom.com.br

    Buscapé backend API, receives lead registration, price alerts, and user data; fingerprint is sent as `fingerprint` field in lead POST

What it can do

Permissions this extension asks for, as declared in version 10.22.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Keep running in the background while your browser is open

    background

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Show you desktop notifications

    notifications

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Receive push messages from its developer's servers

    gcm

Updated 21 September 2026hilpchhlogijamlemmggobblmfcdkomg