Is ChromeXT - Flash Sale Extension safe?

Medium risk

ChromeXT sends the full URL of each new site you visit to its servers and may trigger affiliate redirects.

On every http(s) page load, the extension posts the full tab URL and a persistent user ID to api.chromext.app, once per hostname every 30 minutes. The server's reply can direct the extension to open a hidden tab, inject a hidden iframe, or run a background fetch to an affiliate link, with no user interaction.

v3.8.1Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension posts the full URL of each new site and a persistent ID to its server

Code analysis shows each new site you open has its full address and a persistent ID posted to api.chromext.app.

The store listing describes price history only.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page on any http or https site.

Fires when the tab status becomes loading.

The extension did this

The extension posts the page URL and a persistent uid to api.chromext.app.

Once per new hostname within a 30 minute cache window.

JSON body of the POST to /api/affiliate/check
  • url
    https://example.com/some/path?q=1 (illustrative)

    Address of the page you are loading, including path and query string.

  • uid
    a1b2c3d4-0000-4000-8000-000000000000 (illustrative)

    Persistent identifier read from extension sync storage; the same on every request.

  • X-Extension-ID header
    jdndlnfepifglbjmdmplkjlohafgjfak

    The extension's own ID, sent as a request header.

The code that does this

Listener and POST in the service worker bundle

Readable version

Listener

assets/index.ts-D1Qthcv8.js:806
chrome.tabs.onUpdated.addListener((t, e, a) => {  var s;  "loading" === e.status && (null == (s = a.url) ? void 0 : s.startsWith("http")) && y(a.url, t).catch(t => {}),

POST of full URL and uid

assets/index.ts-D1Qthcv8.js:207
const e = "https://api.chromext.app/api/affiliate/check",  a = await fetch(e, {    method: "POST",    headers: {"Content-Type": "application/json", Accept: "application/json", "X-Extension-ID": chrome.runtime.id},    body: JSON.stringify(t)  });...}({ url: t, uid: e })
Destination of the request
    • api.chromext.app

    Receives the visited URL and uid; replies with an affiliate check result that is cached locally.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed ChromeXT - Flash Sale Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.chromext.app

    ChromeXT - Flash Sale Extension sends data to api.chromext.app. No other extension we have analysed sends data here.

Updated 15 October 2026jdndlnfepifglbjmdmplkjlohafgjfak