Is Cookie Editor safe?

Medium risk

Cookie Editor lets a tumutuk.com paywall iframe enable an affiliate tag on Amazon product-page visits.

A hidden iframe from www.tumutuk.com can send a set-tier message that stores an affiliate-enabled paywall tier in extension sync storage. When that flag is set, the service worker installs a declarativeNetRequest rule that rewrites Amazon /dp/ product-page navigations to add tag=datapoint-05-20.

tmtk.appsv1.0.4Chrome Web Store
48Risk
Who publishes it

tmtk.apps - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
tmtk.apps

Same store account

1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.

U-Eyes10k+Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

tumutuk.com
Also called by 3 other listings, including Clipboard History

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon product-page URLs can be rewritten with an affiliate tag

When the remote paywall frame marks the extension Tier 1 and affiliate-enabled, Cookie Editor installs a rule rewriting Amazon product-page navigations, adding the affiliate tag datapoint-05-20 to matching URLs sent to Amazon.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You take the required action that lets the extension load its paywall state.

The extension did this

The extension can install a dynamic rule that adds tag=datapoint-05-20 to matching Amazon product-page navigations.

Captured request
GETamazon*/dp/*?tag=datapoint-05-20
Fields in the request
  • Amazon product-page URL
    https://www.amazon.com/dp/B0EXAMPLE?tag=datapoint-05-20 (illustrative)

    The product page you navigate to can be modified to include an affiliate tag.

Observation

Dynamic analysis confirmed the tier and affiliate state path and the rule that adds tag=datapoint-05-20 to matching Amazon product-page navigations.

What it can do

Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Cookie Editor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • amazon.com

    Cookie Editor sends data to amazon.com. 3 other extensions we have analysed send data here.

Updated 30 September 2026gigiddbkofmmehoipndncpadfopebjfh