Is Coupert BR - Encontre Cupons e Cashback safe?

Medium risk

Coupert BR sends the full URL of every http(s) page you visit to its servers to look up coupons and cashback.

On each page load, the content script asks the background worker for store info, and the worker posts the complete tab URL, including path and query string, to Coupert's API. No bundled list of supported stores limits this, so non-shopping pages are sent too, excluding a denylist of large sites. A telemetry logger also batches events carrying the page URL and domain to a separate logging host every minute.

v6.60.42Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Coupert sends the full address of every web page you open to its servers

Code analysis shows the extension sends the full URL, including path and query string, of each http(s) page you load to www.coupert.com, with no local list limiting this to shopping sites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page, shopping related or not.

The extension did this

The extension posts that page's full address to www.coupert.com to ask whether it is a supported store.

Data sent per page load
  • Full page URL
    https://example.com/account/orders?id=48213&ref=email

    The complete address, including path and any query string.

  • Feature flags
    cashback=1, affiliate=1, lever=1, coupons=1

    Requests for cashback, affiliate, lever and coupon data.

  • Config lookup URL
    /config?local_date=2026-10-01&url=https://example.com/account/orders?id=48213

    The same address is also placed in a config query string.

The code that does this

Page URL forwarded to the lookup endpoint

Readable version

Content script sender

content.js
get: async function(e, t) {  const n = window.location.href,    i = e || n,    a = r.Z.get(i),    s = (null == a ? void 0 : a.url) || i,    c = (null == a ? void 0 : a.sourceUrlRules) || [];  return await o.ZP.cs().send("store:get", {    url: s,    options: t,    sourceUrlRules: c  }, {    to: o.ZP.Env.BACKGROUND_PAGE  })

Background requests

background.js
function Qs(e) {  return ve("/storev2/info", {    method: "post",    data: R().stringify({      url: e,      cashback: 1,      affiliate: 1,      lever: 1,      coupons: 1,      reason: $.r7    }),    version: 4  })}function Gn(e) {  const {    url: t = ""  } = {    ...e  };  return ve(`/config?local_date=${D()().format("YYYY-MM-DD")}&url=${t}`, {    version: 7  })}
Destinations in the code
    • www.coupert.com

    Receives the page URL at /api/v2/storev2/info and /config.

    • eventmonitoringpro.com

    Receives batched telemetry events carrying page URL and domain fields, flushed each minute.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Coupert BR - Encontre Cupons e Cashback contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.coupert.com

    Coupert BR - Encontre Cupons e Cashback sends data to www.coupert.com. 9 other extensions we have analysed send data here.

  • eventmonitoringpro.com

    Coupert BR - Encontre Cupons e Cashback sends data to eventmonitoringpro.com. 7 other extensions we have analysed send data here.

Updated 15 October 2026ceidgambojhojfhmejceeedijjcpcjga