Is Extension Club R safe?

Medium risk

Extension Club R reads the Rakuten auth cookie and sends the decoded member ID to Google Analytics on user interaction events.

The extension reads the locale-specific Rakuten authentication cookie ("am-plugin-m" or "userHashedID") from the Rakuten homepage, base64-decodes it to obtain a member ID, and stores it locally. For non-French locales, it appends that ID as a custom dimension (cd8/user_uuid) to every analytics event POSTed to Google Analytics Measurement Protocol. This means Rakuten member identity is transmitted to Google Analytics alongside standard engagement events.

Rakutenv3.0.8.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Rakuten Member ID Sent to Google Analytics on Every Interaction

Signed into Rakuten on rakuten.de, .es, or .co.uk, Extension Club R decodes your account cookie for your member ID, attaching it to Analytics events per popup click.

A planted cookie marker appeared in the outgoing POST; French excluded.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You're signed into your Rakuten account and interact with the Extension Club R popup, such as clicking a category link.

This applies to the German, Spanish, and English/UK builds of the extension.

The extension did this

The extension attaches your Rakuten member ID to that analytics event and sends it to Google Analytics.

The ID comes from decoding your Rakuten account cookie, not from anything you typed into the extension itself.

02EvidenceFIELD TABLE
Fields sent to Google Analytics on every interaction
FieldValueWhy it matters
Your Rakuten member ID
<redacted>A persistent identifier tied to your Rakuten account, letting Google Analytics link extension activity to your real account across sessions.
Event name
Category_clickWhich UI element inside the extension you interacted with.
Analytics client ID
a1e4c9d2-7f3b-4e11-9c2a-6d8f1b2a44c7A random per-install identifier generated the first time the extension runs, used to group your events together.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-QDDK1DW7RG&api_secret=<redacted>
200 OK. A planted marker value placed in the Rakuten account cookie during our test session appeared in this exact request, in both user_properties.uuid.value and events[0].params.user_uuid, confirming the account cookie value reaches Google Analytics.
Headers
Content-Typeapplication/json;charset=utf-8
Body
{
  "client_id": "a1e4c9d2-7f3b-4e11-9c2a-6d8f1b2a44c7",
  "timestamp_micros": "1755302410000000",
  "user_properties": {
    "uuid": {
      "value": "<redacted>"
    }
  },
  "events": [
    {
      "name": "Category_click",
      "params": {
        "engagement_time_msec": 340,
        "event_category": "Category",
        "event_action": "click",
        "event_label": "electronics",
        "event_source": "extension",
        "user_uuid": "<redacted>"
      }
    }
  ]
}
04EvidenceCODE COMPARE
The code that does this

Reading the account cookie, then attaching it to every GA event

What it actually does
checkUserCookie() — bg/bundle.js:2822-2850bg/bundle.js
var checkUserCookie = function () {
  return getSettings().then(function (settings) {
    return new Promise(function (resolve) {
      chrome.cookies.get(
        {
          url: LOCALE_CONFIG[settings.language].HOME_PAGE,
          // COOKIE_NAME is "am-plugin-m" for DE/ES/EN-UK, "userHashedID" for FR
          name: LOCALE_CONFIG[settings.language].COOKIE_NAME,
        },
        function (cookie) {
          if (cookie) {
            var decoded = "";
            if (settings.language !== "fr") {
              try {
                // base64-decode the account cookie -> Rakuten member ID
                decoded = atob(cookie.value);
              } catch (e) {
                resolve(null);
              }
            } else {
              decoded = parseInt(cookie.value, 10);
            }
            if (settings.userId !== decoded) {
              // stored for use in every subsequent analytics event
              setSettings({ userId: decoded });
              clearStates();
            }
          } else if (settings.userId) {
            setSettings({ userId: null });
            clearStates();
          }
          resolve(cookie);
        }
      );
    });
  });
};
sendAnalyticsHit() — bg/bundle.js:3290-3324bg/bundle.js
var sendAnalyticsHit = function (opts) {
  var params = opts.params,
    clientId = opts.cid,
    GA_ID = opts.GA_ID,
    GA_SECRET = opts.GA_SECRET;
  var url =
    "https://www.google-analytics.com/mp/collect?measurement_id=" +
    GA_ID +
    "&api_secret=" +
    GA_SECRET;
  // cd8 is set to the decoded Rakuten member ID when logged in (non-FR)
  var hasMemberId = params.cd8;
  var userProps = hasMemberId
    ? { user_properties: { uuid: { value: params.cd8 } } }
    : {};
  return fetch(url, {
    method: "post",
    body: JSON.stringify(
      Object.assign(
        {
          client_id: clientId || randomUuid(),
          timestamp_micros: Date.now() + "000",
        },
        userProps,
        {
          events: [
            {
              name: params.ea.replace(/\s/g, "_"),
              params: Object.assign(
                {
                  engagement_time_msec: Math.floor(1000 * Math.random()) + 100,
                  event_category: params.ec,
                  event_action: params.ea,
                  event_label: params.el,
                  event_source: "extension",
                  // same member ID, duplicated into the event params
                  user_uuid: params.cd8,
                },
                otherParams
              ),
            },
          ],
        }
      )
    ),
  });
};
05EvidenceTHIRD PARTY LIST
Where your Rakuten member ID goes
  • www.google-analytics.com

    Google's GA4 Measurement Protocol endpoint. Receives your decoded Rakuten member ID as a persistent identifier with every popup interaction event, for the DE, ES, UK builds.

Data recipients

www.google-analytics.com
Updated 17 September 2026hnchgcelpejnpglbnaieofanfoikiepb