Is Cashbe: Serviço de Cashback safe?

Medium risk

Cashbe can disable other installed extensions, listed by a remote config, when a cashback offer is activated.

The extension downloads a list of extension IDs from cashbe.com.br and turns off any matching installed extensions while cashback is being activated, then re-enables them afterward. If the user opts in to analytics, it also reads search-result pages (query, titles, links, snippets) that match affiliate merchants and sends them to analytics.troywell.org.

v1.0.14.8Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Cashback extension can disable other extensions from a server ID list

Code analysis shows the extension fetches a list of extension IDs from cashbe.com.br and calls the management API to turn off any that are enabled, around cashback activation.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You activate cashback on a merchant site.

The extension did this

The extension compares your enabled extension IDs with a server list and can turn off matches.

Inputs that drive the extension-management call
  • Any-time ID list
    config.data.anyTime

    Server-supplied IDs matched against your enabled extensions at startup and activation.

  • Activation-time ID list
    config.data.activationTime

    Server-supplied IDs matched when you activate cashback.

  • Enabled extension IDs
    chrome.management.getAll() filtered by enabled

    IDs of extensions currently enabled in your browser profile.

  • Enabled flag
    false

    false when matches are turned off; true re-enables them after activation.

The code that does this

Server list intersection leads to chrome.management.setEnabled

Readable version

Class Se ('thanos') constructor

deobfuscated/bg/bundle.js
          i(this, t), this.name = "thanos", this.data = {}, this.browser = e.browser, this.state = !1, this.allExt = [], this.ignoreId = "", this.init()        }        var e, n, a, s, u;        return o(t, [{          key: "init",  ...

controller() intersects config lists with installed IDs

deobfuscated/bg/bundle.js
                  if (this.state) {                    t.next = 5;                    break                  }                  return t.abrupt("return");                case 5:                  return i = (0, v.intersection)((0, v.get)(null === (n = this.configs) || void 0 === n ? void 0 : n.data, r, []), this.allExt), t.next = 8, (0, v.each)(i, (function(t) {                    a.toggleExtension(t, e)                  }));                case 8:                case "end":                  return t.stop()              }            }), t, this)

toggleExtension and checkState

deobfuscated/bg/bundle.js
        }, {          key: "toggleExtension",          value: function(t) {            var e = !(arguments.length > 1 && void 0 !== arguments[1]) || arguments[1];            try {              if (t === this.ignoreId) return;              chrome.management.setEnabled(t, e)            } catch (t) {}          }        }, {          key: "checkState",          value: (e = r(d().mark((function t() {            var e, n;            return d().wrap((function(t) {              for (;;) switch (t.prev = t.next) {                case 0:                  return t.next = 2, kt("caa.core.settings");                case 2:                  e = t.sent, n = (0, v.get)(e["caa.core.settings"], "isProtected"), this.state = "yabrowser" !== this.browser && "firefox" !== this.browser && !!chrome.management && n;                case 5:                case "end":
Remote host supplying the ID lists
    • cashbe.com.br

    Serves /api/configs/thanos, whose anyTime and activationTime lists are compared with enabled extension IDs.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Cashbe: Serviço de Cashback contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.troywell.org

    Cashbe: Serviço de Cashback sends data to analytics.troywell.org. No other extension we have analysed sends data here.

  • cashbe.com.br

    Cashbe: Serviço de Cashback sends data to cashbe.com.br. No other extension we have analysed sends data here.

Updated 15 October 2026iihbmmdlbkgjaednbpfjckkchloagcbb