Is CNfans Modal Remover safe?

Medium risk

CNfans Modal Remover rewrites CNFans product and account URLs to 2024 subdomains and adds affiliate ref=56000.

On CNFans pages, the extension runs a content script at document start and repeatedly checks the current page URL. For product pages it redirects the browser to a 2024-prefixed CNFans host, adds ref=56000, and converts platform into shop_type; it also redirects the main account page to a 2024-prefixed host.

ebhoergerv1.6Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

CNfans Modal Remover rewrites product links to carry affiliate ref=56000

The extension rewrites CNFans product pages onto a 2024. subdomain and appends the referral code ref=56000.

Dynamic analysis captured the redirect and 3332 requests carrying the injected code, beyond the advertised modal removal.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a CNFans product page, or click through to one from a listing.

The extension is scoped to *://*.cnfans.com/* and runs at document_start, so it acts before the page finishes loading.

The extension did this

The extension sends you to a 2024. version of the same address with the referral code ref=56000 added.

A red progress bar reading EXTENSION FIXING RISK REMINDER covers the page while the navigation happens.

Captured request
GEThttps://2024.cnfans.com/product?id=987654321&shop_type=taobao&ref=56000

301. Observed during dynamic analysis after a client-side route change to a CNFans product page. The rewritten navigation reached the network before any un-rewritten request could.

What the extension changes in the address bar
  • Website host
    cnfans.com becomes 2024.cnfans.com

    You are moved onto a different subdomain of the shopping site before the page you asked for loads.

  • Referral code
    ref=56000

    A fixed referral code is attached so the purchase is credited to whoever owns that code.

  • Shopping platform field
    platform=taobao becomes shop_type=taobao

    The parameter naming the source marketplace is renamed so the rewritten page still resolves.

  • Account landing page
    /my-account/ becomes 2024.cnfans.com/my-account/

    Your account page is also pushed onto the 2024. host, while deeper account pages are pushed back.

The code that does this

The rewrite and redirect, as shipped

Readable version
// content.js runs on every *://*.cnfans.com/* page at document_start.// Annotated control flow of updateProductURL():const updateProductURL = () => {  const url = new URL(window.location.href);  // 1. On /product pages the shopping-platform parameter is renamed:  //    ?platform=taobao  becomes  ?shop_type=taobao  if (url.pathname === '/product' && url.searchParams.get('id') && url.searchParams.get('platform')) {    url.searchParams.set('shop_type', url.searchParams.get('platform').toLowerCase());    url.searchParams.delete('platform');  }  // 2. Any /product path is moved to the 2024. subdomain of the current host  //    and the referral parameter ref=56000 is appended when no ref is present.  //    56000 is hardcoded in the shipped file; it is the only referral value present.  if (url.pathname.startsWith('/product')) {    if (!url.hostname.startsWith('2024.')) url.hostname = '2024.' + url.hostname;    if (!url.searchParams.has('ref')) url.searchParams.set('ref', '56000');    if (window.location.href !== url.href) {      showLoadingBar();                 // red bar reading "EXTENSION FIXING RISK REMINDER"      window.location.replace(url.href); // full navigation, replaces the history entry    }  }  // 3. The account landing page is also pushed onto the 2024. host,  //    while deeper account pages are pushed back to the plain host.  if (url.pathname === '/my-account/' && !url.hostname.startsWith('2024.')) {    url.hostname = '2024.' + url.hostname;    window.location.replace(url.href);  } else if (url.hostname.startsWith('2024.') && url.pathname.startsWith('/my-account/') && url.pathname !== '/my-account/') {    url.hostname = url.hostname.replace('2024.', '');    window.location.replace(url.href);  }};// updateProductURL() is called three ways, so the rewrite is re-applied continuously://   - once after the consent popup resolves (chrome.storage.sync 'affiliate_consent')//   - once on initial page load//   - on every MutationObserver callback over document.body (childList + subtree)
The redirect repeats when the site bounces the request back
  1. immediately

    You did

    You land on a CNFans product page with no referral code on it.

    The extension did

    You are navigated to the 2024. host with ref=56000 attached.

  2. on each bounce

    You did

    The site answers the 2024. address with a redirect back to the plain address.

    The extension did

    The extension rewrites the address again and navigates again.

  3. every DOM update

    You did

    The page keeps changing as each navigation loads.

    The extension did

    Each page change re-runs the rewrite, so the cycle continues while you stay on the page.

Where the rewritten navigation goes
    • 2024.cnfans.com

    Receives the rewritten product and account requests carrying ref=56000. Operated by the shopping site itself, not a separate vendor.

    • cnfans.com

    The address you originally asked for. Requests to it are replaced by the rewritten navigation before they load.

What it can do

Permissions this extension asks for, as declared in version 1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on cnfans.com

    *://*.cnfans.com/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed CNfans Modal Remover contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 2024.<cnfans-host>

    CNfans Modal Remover sends data to 2024.<cnfans-host>. No other extension we have analysed sends data here.

Updated 30 September 2026cpcaampjboceljmgjbohpdmhecidkkai