Is Faceit Stats by Eloking safe?

Medium risk

Faceit Stats by Eloking sends Steam profile lookups to FACEIT with a bundled API bearer token.

When you view a Steam profile, the extension looks up the profile's CS2 FACEIT data through open.faceit.com. Its background service worker adds a hardcoded FACEIT API bearer token to those requests, so the credential is shipped inside every installed copy of the extension.

elokingv5.8Chrome Web Store
45Risk
Who publishes it

eloking - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Faceit Stats by Eloking ships one hardcoded FACEIT API token to every install

Faceit Stats by Eloking embeds one FACEIT API bearer token in its background script, so every install shares the same credential.

The token returns live FACEIT profile data; the same request without it returns HTTP 403.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You open a Steam Community profile page.

Any URL matching steamcommunity.com/id/* or /profiles/*.

The extension did this

The extension's background script requests your FACEIT profile using a bearer token hardcoded in its own source code.

The same token value ships inside every copy of the extension; it is not tied to your account.

Captured request
GEThttps://open.faceit.com/data/v4/players?game=cs2&game_player_id=76561198034202275

HTTP 200 with the player's FACEIT profile (player ID, nickname, CS2 elo). The identical request with the Authorization header removed returns HTTP 403 'not authorized'.

Headers
Accept
application/json
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Authorization
Bearer <redacted>
What every request carries
  • Authorization header
    Bearer <redacted>

    A single fixed API credential is sent on every request, identical across every install of the extension.

  • Steam ID
    76561198034202275

    Your SteamID64, read from the profile page you're viewing, is used to build the FACEIT lookup.

Third-party destinations
    • open.faceit.com

    FACEIT's public player-stats API. Receives the SteamID64 from every profile page you view, authenticated with the extension's shared bearer token.

Reproduce it yourself

Extracts the bearer token from a local unpacked copy of the extension's background.js, then shows FACEIT's API accepting it and rejecting the same request without it.

Requires
  • Python 3.8+
  • A local unpacked copy of the extension
faceit_token_poc.py · py
#!/usr/bin/env python3"""Proves the FACEIT bearer token hardcoded in this extension's background.jsis a live, working API credential shared by every install.The script never hardcodes the token itself; it extracts whatever value ispresent in the background.js you point it at."""import reimport sysimport urllib.requestimport urllib.errorPLAYER_URL = (    "https://open.faceit.com/data/v4/players"    "?game=cs2&game_player_id=76561198034202275")def extract_token(path):    with open(path, "r", encoding="utf-8") as f:        src = f.read()    match = re.search(r"Bearer\s+([0-9a-fA-F-]{36})", src)    if not match:        raise SystemExit(f"No bearer token found in {path}")    return match.group(1)def fetch(url, token=None):    headers = {"Accept": "application/json"}    if token:        headers["Authorization"] = f"Bearer {token}"    req = urllib.request.Request(url, headers=headers)    try:        with urllib.request.urlopen(req) as resp:            return resp.status    except urllib.error.HTTPError as e:        return e.codeif __name__ == "__main__":    bg_path = sys.argv[1] if len(sys.argv) > 1 else "background.js"    token = extract_token(bg_path)    status_with = fetch(PLAYER_URL, token)    status_without = fetch(PLAYER_URL, None)    print(f"WITH extracted token:    HTTP {status_with}")    print(f"WITHOUT any token:       HTTP {status_without}")
How to run it
  1. 1Unpack the extension (Developer mode, or unzip the .crx).
  2. 2Find scripts/background.js in it.
  3. 3Run: python3 faceit_token_poc.py /path/to/background.js.
  4. 4Compare the two status lines.

What it can do

Permissions this extension asks for, as declared in version 5.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.faceit.com

    https://api.faceit.com/*

  • Read and change your data on open.faceit.com

    https://open.faceit.com/*

Where it sends data

Destinations our analysis observed Faceit Stats by Eloking contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • open.faceit.com

    Faceit Stats by Eloking sends data to open.faceit.com. 4 other extensions we have analysed send data here.

Updated 30 September 2026pkhmoinpecjngkokbmjfdhgecfljcegi