Is Extension de navigateur TopCashback France safe?

Medium risk

Extension de navigateur TopCashback France is medium risk. Code analysis shows a bundled Sleek SDK posts a full DOM snapshot, URL and title of allowlisted shopping pages to api.onsleek.ai when a remote flag is on. No consent check was found on this path.

v7.14.0.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sleek coupon SDK sends page DOM, URL and title to api.onsleek.ai on listed shops

Code analysis shows a bundled Sleek SDK posts a full DOM snapshot, URL and title of allowlisted shopping pages to api.onsleek.ai when a remote flag is on.

No consent check was found on this path.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a cart or checkout page on a shop on the Sleek allowlist.

This applies only when the remote SleekEnabled flag is 'true'.

The extension did this

The page's full HTML, address and title are sent to api.onsleek.ai.

Cart and order details on the page are included in the HTML.

The code that does this

Flag gate, then SDK start with a hardcoded key

Readable version

DOM capture and upload

mf.js
const s = await this.rpcService.captureDomString(),  { supported: n, selector: r } = await this.sleekApiService.postCouponAgentSupportCheck({    domString: s,    urlString: G.window.location.href,    title: document.title,    userAgent: G.navigator.userAgent  });

Order extraction on cart pages

mf.js
order: (await this.sleekApiService.postOrderExtractionCart({  domString: await this.rpcService.captureDomString(),  urlString: G.window.location.href})).order
Body of the support-check POST
  • Page HTML
    <html lang="en"><head>...</head><body>... cart rows ...</body></html> (illustrative)

    The serialised document including same-origin iframes.

  • Page address
    https://www.example-shop.com/cart?session=a1b2 (illustrative)

    The full URL of the page you are on.

  • Page title
    Your Shopping Cart | Example Shop (illustrative)

    The title shown in your tab.

  • Browser string
    Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130.0.0.0

    Your browser and OS identifier.

Where the data goes
    • api.onsleek.ai

    Sleek coupon API. Receives DOM, URL and title; paths include /v2/coupon-agent, /v3/page-classifications, /v1/order-extractions.

Check if you're affected

Paste into the service worker DevTools console to log extension requests to api.onsleek.ai.

Requires
  • Chrome with developer mode
find_sleek_calls.js · js
// Logs every fetch the extension makes to api.onsleek.aiconst orig = self.fetch;self.fetch = async (...a) => {  const u = String(a[0]?.url || a[0]);  if (u.includes('api.onsleek.ai')) console.log('[sleek]', a[1]?.method || 'GET', u);  return orig(...a);};
How to run it
  1. 1Open chrome://extensions and inspect the service worker.
  2. 2Paste the script.
  3. 3Browse an allowlisted shop cart page with SleekEnabled true. Also check the tab Network panel.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 15 October 2026pgkgjnjmbjbnhjeinemkfomhagmchcfg