Is Economize! Mundo Conectado safe?

Medium risk

Economize! Mundo Conectado extracts shopping-page values and sends them to its vendor backend.

When a visited page matches remotely supplied shopping-flow rules, the extension reads configured page values such as DOM content and form input. It base64-encodes those values with the page URL and posts them to the Mundo Conectado backend.

mundoconectado.extensaov16.49.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension reports the checkout page you visit back to its own backend

On pages matched by a remote rule list, the extension sends the exact page URL to its own server.

We confirmed this by visiting a checkout page; a companion field for on-page order data was empty in our test.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a page whose URL matches a rule in the extension's remote store list.

In our test, a Netshoes checkout confirmation URL matched store rule 5.

The extension did this

The extension's background worker sends the exact page URL to the vendor's own backend.

It also sends the store ID and any page fields the matched rule tries to extract.

Captured request
POSThttps://economize.mundoconectado.com.br/actions/post/flow
Headers
Content-Type
application/x-www-form-urlencoded
Body
store_id=5&flow=W3sidHMiOjE3ODg5MDIyNDAsInR5cGUiOiJsb2MiLCJ2YWx1ZSI6Imh0dHBzOi8vd3d3Lm5ldHNob2VzLmNvbS5ici9jaGVja291dC9wYXltZW50L2NvbmZpcm0vMTIzNDU2In1d&values=e30=
Why you can't catch this in DevTools

The visited-page record is base64-encoded JSON before it is sent, so it does not read as a URL in a quick look at network traffic.

Decoded value
[  {    "ts": 1788902240,    "type": "loc",    "value": "https://www.netshoes.com.br/checkout/payment/confirm/123456"  }]
Fields in the actions/post/flow request
  • Store ID
    5

    Identifies which retailer's remote rule matched the page you were on.

  • Visited page URL
    https://www.netshoes.com.br/checkout/payment/confirm/123456

    The exact address of the page you were viewing when the rule matched, sent verbatim.

  • Extracted page fields
    {}

    Values the remote rule pulls from the page via a CSS selector, an embedded JSON block, or a page script variable.

The code that does this

Remote rule match, extraction, and the outbound POST

Readable version

Content script: matches the page URL and extracts fields

index.js
function useFlowWatcher() {  const { bubble, stores } = useAppState();  const dispatch = useDispatch();  useEffect(() => {    const storeId = stores.genericPage?.idloja;    if (!bubble.currentUrl || !storeId) return;    const flowRule = stores.genericPage?.flow;    if (!flowRule) return;    dispatch(appendFlowLocation({ storeId, url: bubble.currentUrl }));    extractIfUrlMatches(bubble.currentUrl, flowRule).then((extracted) => {      if (extracted) dispatch(sendFlow({ storeId, values: extracted }));    });  }, [bubble.currentUrl, stores.genericPage]);  return null;}async function extractIfUrlMatches(currentUrl, flowRule) {  if (!flowRule.ativo) return null;               // remote enabled flag  const urlPattern = new RegExp(flowRule.url, "i"); // remote regex  return urlPattern.test(currentUrl) ? await extractFields(flowRule) : null;}async function extractFields(flowRule) {  const rules = flowRule.data || [];  const result = {};  for (const rule of rules) {    result[rule.nome] = await extractOneField(rule); // selector / script_var / regex  }  return result;}

Background worker: assembles and sends the POST

background.js
onMessage('bg_sendFlow', async ({ storeId, values }, _sender, sendResponse) => {  const posted = await postFlow(storeId, values);  sendResponse({ status: true, result: posted });});const postFlow = async (storeId, extractedValues) => {  const store = getStore(storeId);  const locationHistory = await store.getQueuedLocations();  const body = {    store_id: storeId,    flow: btoa(JSON.stringify(locationHistory)),    // visited-URL history, base64    values: btoa(JSON.stringify(extractedValues))   // extracted page fields, base64  };  return await api.post('actions/post/flow', body, { ttl: FLOW_POST_TTL });};
Where the data goes
    • economize.mundoconectado.com.br

    The extension vendor's own backend. Receives the visited page URL and any store-rule-extracted values for every matched page.

What it can do

Permissions this extension asks for, as declared in version 16.49.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on economize.mundoconectado.com.br

    https://economize.mundoconectado.com.br/**/*

  • Sign you in with your Google account

    identity

Where it sends data

Destinations our analysis observed Economize! Mundo Conectado contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • economize.mundoconectado.com.br

    Economize! Mundo Conectado sends data to economize.mundoconectado.com.br. No other extension we have analysed sends data here.

Updated 30 September 2026inabndbiklomhjaljieihbhigmeoicbg