Is Coupert ES - Buscador de cupones & Cashback safe?

Medium risk

Coupert ES sends the URLs of all open tabs, in an obfuscated payload, to eventmonitoringpro.com on install and update.

When the extension is installed or updated, its background worker reads the URL, active, pinned and incognito state of every open tab, encodes the list, and posts it to eventmonitoringpro.com. Separately, on most http(s) pages outside a built-in list of sensitive domains, it sends the full page URL to www.coupert.com to look up coupons and cashback, caching the result per subdomain.

v6.60.58Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Coupert sends every open tab URL to eventmonitoringpro.com on install and update

Code analysis shows that on install and update the extension lists all open tabs, any site, and sends their URLs and flags to eventmonitoringpro.com in an encoded field.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You install the extension or it updates to a new version.

The extension did this

It reads every open tab and sends their URLs and flags to eventmonitoringpro.com.

The code that does this

Tab collector run before the install event is sent

Readable version

Tab collector (module 43962)

background.js
async function s() {  const e = await o().tabs.query({});  if (!e || !e.length) return {};  const t = e.map((e => {    let { id: t, active: n, url: i, incognito: o, pinned: a } = e;    return { id: t, active: n, url: i, incognito: o, pinned: a }  }));  return (0, a.DD)(t)}

Install event call that triggers it

background.js
(0, _.AddExt0001Evt)({  [g.Fn.Status.key]: g.Zn.INSTALL}, {  apiAvailable: e,  clientId: n})
Fields collected per open tab
  • Tab URL
    https://www.example.com/orders?id=1042

    The full address of each open page, including any query string.

  • Tab id
    1184

    The browser's number for the tab.

  • Active flag
    true

    Whether the tab is the one in front.

  • Pinned flag
    false

    Whether the tab is pinned.

  • Incognito flag
    false

    Whether the tab is in a private window.

Destination of the event
    • eventmonitoringpro.com

    Receives the ext0001 event with the encoded tab list at /v1/log; the decoding key is sent with it.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Coupert ES - Buscador de cupones & Cashback contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.coupert.com

    Coupert ES - Buscador de cupones & Cashback sends data to www.coupert.com. 9 other extensions we have analysed send data here.

  • eventmonitoringpro.com

    Coupert ES - Buscador de cupones & Cashback sends data to eventmonitoringpro.com. 7 other extensions we have analysed send data here.

Updated 15 October 2026ggmfepplldondfbcpilbpeapopiggfni