Is CouponsMe safe?

Medium risk

CouponsMe fetches a domain list over plain HTTP and loads server-chosen URLs in hidden iframes on matching shopping sites.

Every 25 minutes the extension requests a list of shopping domains from luwebsearchep.com. When you visit a matching site, it asks the server for a URL and injects it as a hidden, invisible iframe into the page, and may also open a background tab to a server-chosen address. The URLs are not validated, the traffic is unencrypted, and the page does not disclose this behavior.

CouponsMe!v1.3.5Chrome Web Store
49Risk
Who publishes it

CouponsMe! - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
CouponsMe!
Website
www.couponsme.online/#contact

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

mojocart.com
Also called by 1 other listing: Mojo - Automatic Coupons at Checkout

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

CouponsMe adds a server-chosen off-screen iframe or tab on listed sites

Code analysis shows that on server-listed domains the extension adds a off-screen iframe or opens a background tab, using URLs fetched over plain HTTP from luwebsearchep.com.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open a shopping site that appears in the server's domain list.

The extension did this

The extension adds a off-screen iframe to the page and may open a background tab, both pointing at server-chosen URLs.

The code that does this

Iframe injection and background tab handlers

Readable version

Result handling

background.m.js
const { endpoint: i, T: e } = t[0];i && "" != i && this.ht(i, s), e && "" != e && this.rt(e)
Values requested from the server
  • Domains request
    http://luwebsearchep.com/domains?key=<redacted>&uid=...&zone=...&extension=<runtime id>

    Retrieves the list of sites that trigger the behaviour.

  • Endpoint request
    http://luwebsearchep.com/endpoint/<domain>

    Sent with the visited domain; returns the iframe URL and tab URL.

  • Install uid
    uid persisted in extension storage

    An identifier from the /install call, stored locally and sent with each request.

Remote host contacted
    • luwebsearchep.com

    Supplies the domain list, iframe URL and tab URL over plain HTTP; receives the install uid and visited domain.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed CouponsMe contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • luwebsearchep.com

    CouponsMe sends data to luwebsearchep.com. No other extension we have analysed sends data here.

Updated 15 October 2026jlndbkimnlkdfakagpnjdihlagmholeh