Is ClickApporter safe?
ClickApporter sends Amazon cart, product-view history, search terms, and saved-item ASINs to clickapporter.com during checkout.
When you use ClickApporter on Amazon France or Amazon.com, it stores product page ASINs you viewed, Amazon search keywords with result ASINs, and saved-cart ASINs in local extension storage. When you click the extension's checkout button, it submits those records along with cart data to ClickApporter's checkout endpoint.
Who publishes itclickapporter - no other listings under this identity, 2 shared hostnames
clickapporter - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Amazon shopping history is sent to ClickApporter during checkout
When you use ClickApporter on Amazon and start checkout, the extension submits your product-view history, search terms, and saved-cart ASINs.
The POST to clickapporter.com/process-cart.html includes browsing history, URLs, and stored data.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You click the checkout button after browsing Amazon with ClickApporter enabled.
The extension submits Amazon product-view history, search terms, and saved-cart ASINs to ClickApporter.
- Your Amazon browsing historyB08N5WRWNW at Amazon.com, 2026-07-13T08:00:00Z (illustrative)
Product-page ASINs, store context, and timestamps can describe which Amazon items you viewed before checkout.
- Amazon page URLshttps://www.amazon.com/s?k=wireless+keyboard (illustrative)
URLs can reveal the Amazon pages and searches that led to checkout.
- Stored shopping datasavedItems=["B08N5WRWNW","B07K1RZWMC"] (illustrative)
Extension storage values include saved-cart ASINs, search keywords, search-result ASINs, and cart data used in the submission.
Observed during dynamic analysis: the checkout submission used fields named cart_data, hist_data, search, and saved_items, matching the stored Amazon shopping context described above.
What it can do
Permissions this extension asks for, as declared in version 6.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on www.amazon.com
https://www.amazon.com/*
Read and change your data on www.amazon.fr
https://www.amazon.fr/*
Read and change your data on www.amazon.es
https://www.amazon.es/*
Read and change your data on www.amazon.de
https://www.amazon.de/*
Show you desktop notifications
notifications
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed ClickApporter Plugin contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.clickapporter.com
ClickApporter Plugin sends data to www.clickapporter.com. No other extension we have analysed sends data here.