Is CNfans Modal Remover safe?
CNfans Modal Remover rewrites CNFans product and account URLs to 2024 subdomains and adds affiliate ref=56000.
On CNFans pages, the extension runs a content script at document start and repeatedly checks the current page URL. For product pages it redirects the browser to a 2024-prefixed CNFans host, adds ref=56000, and converts platform into shop_type; it also redirects the main account page to a 2024-prefixed host.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
CNfans Modal Remover rewrites product links to carry affiliate ref=56000
The extension rewrites CNFans product pages onto a 2024. subdomain and appends the referral code ref=56000.
Dynamic analysis captured the redirect and 3332 requests carrying the injected code, beyond the advertised modal removal.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a CNFans product page, or click through to one from a listing.
The extension is scoped to *://*.cnfans.com/* and runs at document_start, so it acts before the page finishes loading.
The extension sends you to a 2024. version of the same address with the referral code ref=56000 added.
A red progress bar reading EXTENSION FIXING RISK REMINDER covers the page while the navigation happens.
301. Observed during dynamic analysis after a client-side route change to a CNFans product page. The rewritten navigation reached the network before any un-rewritten request could.
- Website hostcnfans.com becomes 2024.cnfans.com
You are moved onto a different subdomain of the shopping site before the page you asked for loads.
- Referral coderef=56000
A fixed referral code is attached so the purchase is credited to whoever owns that code.
- Shopping platform fieldplatform=taobao becomes shop_type=taobao
The parameter naming the source marketplace is renamed so the rewritten page still resolves.
- Account landing page/my-account/ becomes 2024.cnfans.com/my-account/
Your account page is also pushed onto the 2024. host, while deeper account pages are pushed back.
The rewrite and redirect, as shipped
// content.js runs on every *://*.cnfans.com/* page at document_start.// Annotated control flow of updateProductURL():const updateProductURL = () => { const url = new URL(window.location.href); // 1. On /product pages the shopping-platform parameter is renamed: // ?platform=taobao becomes ?shop_type=taobao if (url.pathname === '/product' && url.searchParams.get('id') && url.searchParams.get('platform')) { url.searchParams.set('shop_type', url.searchParams.get('platform').toLowerCase()); url.searchParams.delete('platform'); } // 2. Any /product path is moved to the 2024. subdomain of the current host // and the referral parameter ref=56000 is appended when no ref is present. // 56000 is hardcoded in the shipped file; it is the only referral value present. if (url.pathname.startsWith('/product')) { if (!url.hostname.startsWith('2024.')) url.hostname = '2024.' + url.hostname; if (!url.searchParams.has('ref')) url.searchParams.set('ref', '56000'); if (window.location.href !== url.href) { showLoadingBar(); // red bar reading "EXTENSION FIXING RISK REMINDER" window.location.replace(url.href); // full navigation, replaces the history entry } } // 3. The account landing page is also pushed onto the 2024. host, // while deeper account pages are pushed back to the plain host. if (url.pathname === '/my-account/' && !url.hostname.startsWith('2024.')) { url.hostname = '2024.' + url.hostname; window.location.replace(url.href); } else if (url.hostname.startsWith('2024.') && url.pathname.startsWith('/my-account/') && url.pathname !== '/my-account/') { url.hostname = url.hostname.replace('2024.', ''); window.location.replace(url.href); }};// updateProductURL() is called three ways, so the rewrite is re-applied continuously:// - once after the consent popup resolves (chrome.storage.sync 'affiliate_consent')// - once on initial page load// - on every MutationObserver callback over document.body (childList + subtree)immediately
You didYou land on a CNFans product page with no referral code on it.
The extension didYou are navigated to the 2024. host with ref=56000 attached.
on each bounce
You didThe site answers the 2024. address with a redirect back to the plain address.
The extension didThe extension rewrites the address again and navigates again.
every DOM update
You didThe page keeps changing as each navigation loads.
The extension didEach page change re-runs the rewrite, so the cycle continues while you stay on the page.
- 2024.cnfans.com
Receives the rewritten product and account requests carrying ref=56000. Operated by the shopping site itself, not a separate vendor.
- cnfans.com
The address you originally asked for. Requests to it are replaced by the rewritten navigation before they load.
What it can do
Permissions this extension asks for, as declared in version 1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on cnfans.com
*://*.cnfans.com/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed CNfans Modal Remover contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 2024.<cnfans-host>
CNfans Modal Remover sends data to 2024.<cnfans-host>. No other extension we have analysed sends data here.