Is Datemyage - Мультиаккаунт - чаты/письма safe?
Datemyage Multiaccount downloads a script from its vendor's server and runs it on datemyage.com pages.
On datemyage.com, about 20 seconds after page load, the extension fetches a script from account.chatoptimizer.com and runs it with eval. It also sends the operator's account ID to that server and injects an authorization header and session cookie handling so several accounts can be used in separate tabs. The script served today is not in the extension bundle, so what it does is unknown.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
datemyage.com content script runs a script fetched from chatoptimizer.com
Code analysis shows a datemyage.com content script fetches livescript.js from the vendor backend and passes the response to window.eval.
The served script was not in the bundle, so its behavior is unknown.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open any page on datemyage.com.
The content script is declared for *://*.datemyage.com/* at document end.
About 20 seconds later the extension requests a script from account.chatoptimizer.com and runs the reply.
The reply is passed to window.eval in the page's content script context.
Fetch target, timer, and eval sink in the content script
The source is not minified. The three snippets above are shown as shipped. liveScriptCallback itself is an empty function, so the only effect of the response is the window.eval call.- livescript.jsGET https://account.chatoptimizer.com/media/ext/datemyage.com/livescript.js
Fetched with no integrity check and passed to window.eval.
- Popup templateGET https://account.chatoptimizer.com/ajax/getContentLivePopup
Server HTML is appended to the page body.
- Extension scriptsGET https://account.chatoptimizer.com/api/ext/authExtension
Server-supplied content and interface HTML is loaded, then js/content.js is injected.
- account.chatoptimizer.com
Vendor backend serving the script that is evaluated, popup HTML and extension content.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Datemyage - Мультиаккаунт - чаты/письма contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- account.chatoptimizer.com
Datemyage - Мультиаккаунт - чаты/письма sends data to account.chatoptimizer.com. 8 other extensions we have analysed send data here.