Is FaniMani.pl Donation Reminder safe?
FaniMani.pl Donation Reminder sends visited page URLs with a persistent user identifier to FaniMani stats and Google Analytics.
When its widget, search result, or donation UI appears, the extension logs the current page URL. Its analytics code adds a stable user identifier and posts those events to FaniMani's stats endpoint and Google Measurement Protocol.
Who publishes itFundacja FaniMani - 2 other listings from the same operator, none carrying a finding
Fundacja FaniMani - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 1k+ users between them, none of them carrying a finding.
Shared hosts - 5 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page URLs and a persistent ID are sent during widget and search events.
On pages matching the extension's widget or search-result rules, it sends the page URL with a persistent user identifier.
Confirmed requests went to FaniMani stats and Google Analytics, with URL, history context, and stored ID data.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to a page or search result that matches the extension's rules.
The extension sends widget or search-result event data containing the page URL and a persistent user identifier.
action=widget-inactive-show&url=https://www.amazon.com/&uuid=a-9889d1c55...- Current page URLhttps://www.amazon.com/
Shows the exact page involved in the extension event.
- Browsing-history eventwidget-inactive-show on https://www.amazon.com/
Links automatic navigation-triggered events to pages you visit.
- Stored user identifiera-9889d1c55...
Links repeated extension events to the same browser profile.
Observed during dynamic analysis: the FaniMani stats request carried the widget event, page URL, and persistent identifier, while the Google Analytics request carried the same identifier and page URL fields.
Where it sends data
Destinations our analysis observed FaniMani.pl Donation Reminder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
FaniMani.pl Donation Reminder sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- extension-stats.fanimani.pl
FaniMani.pl Donation Reminder sends data to extension-stats.fanimani.pl. No other extension we have analysed sends data here.