Is CouponBirds: Coupons & Deals safe?

Medium risk

CouponBirds is medium risk. CouponBirds recreates an ID cookie on couponbirds.com after tab activation. Deleting it and opening a tab restored the same userId value. setInstallFlag() writes matching cookies to both domains, 365-day expiry, rearmed early, no prompt.

www.couponbirds.comv4.6.10Chrome Web Store
45Risk
Who publishes it

www.couponbirds.com - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
www.couponbirds.com
Registered address
1312 17th St, Suite 692, Denver, CO 80202, US
Registered contact
CouponBirds
Website
www.couponbirds.com/us/contact-us

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

cdn.ivaws.com
Also called by 4 other listings, including Capital One Shopping, Capital One Shopping: Save Now

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sets a persistent tracking cookie on couponbirds.com at install

CouponBirds recreates an ID cookie on couponbirds.com after tab activation.

Deleting it and opening a tab restored the same userId value. setInstallFlag() writes matching cookies to both domains, 365-day expiry, rearmed early, no prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install CouponBirds, or your browser wakes the extension's background service worker.

The startup routine runs once per service-worker lifecycle, guarded by an internal 'ran once' flag.

The extension did this

The extension writes an 'installed' cookie carrying its own internal userId to couponbirds.com and couponsbirds.com, with no consent prompt.

setInstallFlag() also writes matching app_version and app_type cookies on both domains, all with a 365-day expiration.

Cookie fields written by setInstallFlag()
  • Install ID
    installed=8ArPnmzmJTFxqh1W+rb0CmcRMPZiqS4NF6MsFQPDYPk=

    A persistent identifier tied to your extension install, readable by couponbirds.com and couponsbirds.com as a normal first-party cookie.

  • Extension version
    app_version=4.6.6

    Lets the couponbirds.com backend see which extension build you're running.

  • Browser type
    app_type=chrome

    Tells the backend which browser (Chrome, Edge, etc.) the extension is running in.

  • Cookie lifetime
    365 days from the last renewal, sameSite=no_restriction, secure

    The cookie is set to expire a full year out, and is refreshed before it can lapse.

The code that does this

setInstallFlag() and checkInstallCookie() write and renew the tracking cookie

Readable version

setInstallFlag() — deobfuscated

background.js
setInstallFlag = async e => {  let t = {    url: a + "/",    domain: o,    expirationDate: Math.ceil(((new Date).getTime() + 24 * e * 60 * 60 * 1e3) / 1e3),    name: "installed",    path: "/",    value: await w("userId"),    sameSite: "no_restriction",    secure: !0  };  _(t);  let n = {    url: a + "/",    expirationDate: Math.ceil(((new Date).getTime() + 24 * e * 60 * 60 * 1e3) / 1e3),    name: "app_version",    path: "/",    value: J()  };  _(n);  let r = {    url: a + "/",    domain: o,    expirationDate: Math.ceil(((new Date).getTime() + 24 * e * 60 * 60 * 1e3) / 1e3),    name: "app_version",    path: "/",    value: J()  };  _(r);  let i = {    url: a + "/",    expirationDate: Math.ceil(((new Date).getTime() + 24 * e * 60 * 60 * 1e3) / 1e3),    name: "app_type",    path: "/",    value: this.browserName  };  _(i);  let l = {    url: a + "/",    domain: o,    expirationDate: Math.ceil(((new Date).getTime() + 24 * e * 60 * 60 * 1e3) / 1e3),    name: "app_type",    path: "/",    value: this.browserName  };  _(l);  try {    let t = {      url: "https://www.couponsbirds.com/",      expirationDate: Math.ceil(((new Date).getTime() + 24 * e * 60 * 60 * 1e3) / 1e3),      name: "installed",      path: "/",      value: await w("userId"),      sameSite: "no_restriction",      secure: !0    };    _(t)  } catch (e) {}};

checkInstallCookie() — deobfuscated

background.js
checkInstallCookie = async () => {  let e = await M({    name: "installed",    url: a + "/"  });  (S(e) || e.expirationDate - (new Date).getTime() / 1e3 <= 2592e3) && await this.setInstallFlag(365)};

chrome.tabs.onActivated wiring — deobfuscated

background.js
chrome.tabs.onActivated.addListener(t => {  e.onActivatedListener(t), e.checkInstallCookie()});

Cookie helper wrappers — deobfuscated

background.js
M = e => new Promise((t, n) => {  try {    chrome.cookies.get(e, e => t(e))  } catch (e) {    console.log(e), n(e)  }}), _ = e => {  chrome.cookies.set(e)};
When this fires

On an interval

The cookie is written once per service-worker startup, then re-checked on every browser tab activation and renewed whenever it is missing or within 30 days of expiring, in practice a rolling 365-day tracking cookie that never lapses as long as the extension stays installed and you use the browser.

Where the tracking cookie is readable
    • couponbirds.com

    First-party site for the CouponBirds extension; receives the 'installed', 'app_version', and 'app_type' cookies via the domain-scoped chrome.cookies.set() calls.

    • couponsbirds.com

    A second, similarly-named domain that receives a duplicate 'installed' cookie with the same userId value.

Updated 30 September 2026pnedebpjhiaidlbbhmogocmffpdolnek