Is Cashback Easy: Coupons, Promo Codes & Rewards safe?
Cashback Easy reports active tab origins for store matching and sends overlay telemetry to Google Analytics.
Cashback Easy checks the origin of pages you visit against its store-matching API when its content script loads and when tabs become active. Its overlay telemetry also includes the full page URL, a generated client identifier, device type, timestamps, and, when logged in, a subscriber ID that is sent to Google Analytics.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Reports Every Website You Visit to Cashback Easy's Servers
Every time you open or switch to a website, even one unrelated to shopping, Cashback Easy sends that site's address to its own servers automatically.
Observed on ten unrelated test sites with no click required.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new tab or switch to an already-open one, on any website.
This includes sites with no connection to shopping, like a search engine or a news site.
Cashback Easy sends that site's web address to its own servers.
The request fires automatically in the background - no click is needed.
- Website address (origin)https://www.wikipedia.org
The scheme and domain of whatever site you're currently viewing - sent for every site, not only shopping sites.
- Client channel tagplug
A fixed label marking the request as coming from the browser extension rather than the Cashback Easy website.
- Transform flag0
A fixed flag included on every request in the observed traffic.
JSON response naming a matched store/platform ID for the reported address, or none if no store matches.
Tab-switch listener that reports the current site's address
Renamed and reformatted
chrome.tabs.onActivated.addListener((activeInfo) => { chrome.tabs.get(activeInfo.tabId).then(async (tab) => { if (tab?.url && !tab.url.startsWith("chrome://")) { const origin = new URL(tab.url).origin; const result = await externalTransform({ useCache: true, params: { target: origin, channel: "plug" }, }); handleExternalTransformData(result); } });});Renamed and reformatted - the network call
async function externalTransform({ useCache, params }) { if (useCache) { const cacheKey = JSON.stringify(params); const cached = await getExternalTransformCache(cacheKey); if (cached) return cached; } // GET https://www.cashbackeasy.com/api/business/external/transform const response = await api.get("/business/external/transform", { params: { is_transform: 0, ...params }, }); if (useCache) setExternalTransformCache(JSON.stringify(params), response); return response;}- www.cashbackeasy.com
Receives the address of every website you visit so Cashback Easy's own backend can check for a matching cashback/coupon store.
Sends Full Page URLs and a Persistent ID to Google Analytics
When Cashback Easy's overlay appears or is clicked, it sends the page address you're viewing, including search terms and product links, to Google Analytics tagged with a persistent cross-site ID.
Observed on Amazon's home and product pages.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You view a page where Cashback Easy's cashback overlay appears, or you click it.
This includes ordinary shopping pages such as a product listing or a search-results page.
The extension sends the exact address of that page to Google Analytics.
The request also carries an ID that stays the same across every site you visit.
- Full page addresshttps://www.amazon.com/s?k=usb+cable
The complete web address of the page you're viewing, including any search terms or product IDs in the URL.
- Persistent client IDd106c4d1-b028-4cab-bebd-f1ddf5e1a903
A random ID generated once per install and reused on every event, letting Google Analytics link your visits together over time.
- Device GUIDf4bc5a56-33da-4c20-b1f7-56fe86e96d97
A second persistent identifier tied to this browser install.
- Account ID (when signed in)(present only when signed in)
Your Cashback Easy subscriber ID, included whenever you're logged into the extension.
204 No Content (standard Measurement Protocol acknowledgement).
{ "client_id": "d106c4d1-b028-4cab-bebd-f1ddf5e1a903", "events": [ { "name": "plug_event", "params": { "page": "https://www.amazon.com/s?k=usb+cable", "guid": "f4bc5a56-33da-4c20-b1f7-56fe86e96d97", "device": "PC", "engagement_time_msec": 100 } } ]}Overlay view/click logger and the Measurement Protocol client it feeds
Renamed and reformatted - the logger hook
function useLogger({ views = [], clicks = [] } = {}) { const [isLoggedIn, userInfo] = useUserInfo(); const buildEventParams = useCallback(async () => { return { page: window.location.href, // full URL of the current page create_time: dayjs().tz("America/New_York").format("YYYY-MM-DD HH:mm:ss"), uid: isLoggedIn ? userInfo?.subscriber_id : undefined, guid: await getGuid(), // persistent device GUID device: getDeviceType(), }; }, [isLoggedIn]); const logEvent = useCallback(async ({ scene, target, module }) => { sendToBackground({ name: "tracking/logger", body: { event: OVERLAY_EVENT, params: { ...(await buildEventParams()), target, module, scene: EventSceneEnum[scene] } }, }); }, [buildEventParams]); useInViewWatch(views, { standing: 500, onStanding: ({ module, target }) => logEvent({ scene: "view", module, target }) }); useClickWatch(clicks, { debounce: 500, onClick: ({ module, target }) => logEvent({ scene: "click", module, target }) });}Renamed and reformatted - the Measurement Protocol client
class GoogleAnalyticsClient { async fireEvent(name, params = {}) { params.session_id ??= await this.getOrCreateSessionId(); params.engagement_time_msec ??= 100; const url = `https://www.google-analytics.com/mp/collect?measurement_id=G-Y601QP87BZ&api_secret=<redacted>`; await fetch(url, { method: "POST", body: JSON.stringify({ client_id: await this.getOrCreateClientId(), // persistent, reused every call events: [{ name, params }], // params.page = full visited URL }), }); }}- google-analytics.com
Google's analytics platform; receives the full page address, a persistent client ID and device GUID, and your Cashback Easy account ID when signed in.
What it can do
Permissions this extension asks for, as declared in version 1.5.18. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs
Store an unlimited amount of data in your browser
unlimitedStorage
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Cashback Easy: Coupons, Promo Codes & Rewards contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Cashback Easy: Coupons, Promo Codes & Rewards sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- www.cashbackeasy.com
Cashback Easy: Coupons, Promo Codes & Rewards sends data to www.cashbackeasy.com. One other extension we have analysed sends data here.