Is Много.ру safe?

Medium risk

Много.ру inserts your stored loyalty card number into remote-selected partner pages.

Its all-sites content script reads the saved card number from extension storage, fetches a partner banner list from dev.mobile.mnogo.ru, and matches the current site's hostname against that list. When a configured partner uses the card-number flow and you are signed in, the extension writes the card number into the page DOM for a copy button, where scripts on that partner page can read it.

mnogo.ruv4.769Chrome Web Store
47Risk
Who publishes it

mnogo.ru - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
mnogo.ru
Website
www.mnogo.ru/quest/callcenter/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mnogo.ru extension writes your loyalty card into partner page DOM

When you visit a website on Mnogo.ru's remote partner list, the extension writes your stored loyalty card number into that page's own DOM.

Any script running on the page can then read it.

No outbound transmission of the card was observed.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit a website whose hostname appears on Mnogo.ru's remote partner list.

The content script runs on every page and checks the hostname against a list fetched from Mnogo.ru's server.

The extension did this

The extension writes your stored Mnogo.ru loyalty card number into that page's own DOM.

Any script running on the matched partner page, not just the extension's own UI, can then read the card number.

Captured request
GEThttps://dev.mobile.mnogo.ru/cache/banners

banners[] entries carry site_url (partner hostname) and text_04; the card-display path activates when text_04 contains 10 for the current hostname.

What's written into the page
  • Mnogo.ru loyalty card number
    7001234567890123 (illustrative)

    Your Mnogo.ru rewards card identifier, written in plaintext into the visited page's own DOM.

Page DOM modified

The content script sets the element's innerHTML to the user's stored loyalty card number, exposing it to any script on the page.

Target
The js-main-partn-card element inserted on matched partner sites, confirmed live on www.maxidom.ru.
Before
<div id="js-main-partn-card" class="main-part__card"></div>
After the extension changed it
<div id="js-main-partn-card" class="main-part__card">7001234567890123 (illustrative)</div>

What it can do

Permissions this extension asks for, as declared in version 4.769. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed %D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D1%80%D1%83 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • remote-configured Mnogo.ru partner websites

    %D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D1%80%D1%83 sends data to remote-configured Mnogo.ru partner websites. Named as a recipient in this extension's own analysis.

Updated 30 September 2026mlkgcabfkfppmonimdklfolalmahlpff