Is Coupert RU - Поиск купона и Cashback safe?

Medium risk

Coupert RU sends a snapshot of shopping and checkout page contents to its own servers for coupon-field detection.

On shopping pages, the extension clones the page body, strips scripts, styles and ads, and posts the resulting HTML with a prompt to Coupert's AI endpoint. This is used to locate coupon input fields and is controlled by remote configuration flags. Event telemetry containing page URLs is also sent to a separate logging host.

v6.60.50Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Coupert sends a cleaned copy of the shopping page you are on to its AI endpoint

Code analysis shows Coupert builds an HTML snapshot of the open page and posts it to coupert.com/api/v2/ai/at-biz to locate coupon fields.

Sending depends on remote flags; this was not observed running.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a shopping or checkout page on a site Coupert is enabled for.

The extension did this

Coupert copies the page HTML and posts it to its AI endpoint to find coupon fields.

Gated by remote flags ai_at, rule_check_ai and ai_coupon.

The code that does this

Snapshot is built and sent from the page

Readable version

Background posts it to the AI endpoint

background.js
    function Oh() {      let e = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : {};      return Kn("/ai/at-biz", {        method: "post",        data: e,        ignoreSignKeys: ["html", "code_input_html", "prompt"]      })    })), u.ZP.bp().on("ai:get_ai_result", (async (e, t, n) => {      try {        const {          content: n = {}        } = e, {          data: i = {}        } = n, o = await async function(e) {          return ut({            request: async () => await Oh(e)          })        }(i);        if (!(0, y.isEmpty)(o) && 0 === (null == o ? void 0 : o.code)) return void t(null == o ? void 0 : o.data);        t(null)      } catch (e) {
What the request carries
  • html
    <div class="cart"><input id="coupon" placeholder="Promo code">...</div>

    A trimmed copy of the page you are viewing, including visible text and forms.

  • prompt
    Find the coupon input and apply button in this HTML

    An instruction wrapped around the page HTML for the AI model.

  • store_id
    48213

    Identifies the shop you are on.

Destination
    • www.coupert.com

    Receives page HTML at /api/v2/ai/at-biz; a remote-config URL override can redirect it.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Coupert RU - Поиск купона и Cashback contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.coupert.com

    Coupert RU - Поиск купона и Cashback sends data to www.coupert.com. 9 other extensions we have analysed send data here.

  • eventmonitoringpro.com

    Coupert RU - Поиск купона и Cashback sends data to eventmonitoringpro.com. 7 other extensions we have analysed send data here.

Updated 15 October 2026nmeeeegiigfnacffbekogiehmhefhpdd