Is FindThatLead - Email Finder Extension safe?
FindThatLead is medium risk. When you click FindThatLead on a non-LinkedIn site, the extension reads email addresses from the page text and sends them to app.findthatlead.com/api/saveDomEmails, along with the source domain and the extension's auth token.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page email addresses sent to FindThatLead after extension click
When you click FindThatLead on a non-LinkedIn site, the extension reads email addresses from the page text and sends them to app.findthatlead.com/api/saveDomEmails, along with the source domain and the extension's auth token.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user clicks the extension on a non-LinkedIn site.
The extension extracts email addresses from the page DOM and sends them to FindThatLead.
- Email addresses in page textperson@example.com (illustrative)
Email addresses visible in the current page can identify people or organizations present in that page content.
LinkedIn profile details sent to FindThatLead after profile scraping.
When you take the required action on a LinkedIn profile, the extension sends profile page content to FindThatLead, including name, email, phone, company, position, skills, LinkedIn IDs, image URL, languages, industry, and company size.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user takes the required action on a LinkedIn profile.
The extension collects LinkedIn profile details and sends them to FindThatLead.
- LinkedIn profile page contentJane Example, jane@example.com, Product Manager at ExampleCo (illustrative)
Profile content can include name, email, phone, employer, role, skills, LinkedIn IDs, image, languages, industry, and company size.
Observed during dynamic analysis: the extension path sends scraped LinkedIn profile data through Scr.updScrPrf to the /api/updScrDb endpoint.
User actions are sent to GTM and Facebook Pixel with a user identifier.
The FindThatLead popup initializes Google Tag Manager and Facebook Pixel and sends action events using the auth token as userId, covering searches, clicks, login, and errors, with search terms, domains, page URL, and tab context.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user performs an action in the extension popup.
The extension sends analytics events to Google Tag Manager and Facebook Pixel with the user's authentication token as userId and action details.
- Page URLhttps://app.example/search?q=lead (illustrative)
Shows the page or popup context associated with the analytics event.
- Tab contextactive tab title and URL (illustrative)
Provides browser tab context that can tie the event to the user's current browsing session.
+1 more finding not shown
What it can do
Permissions this extension asks for, as declared in version 5.9.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Act on the current tab, but only after you click the extension
activeTab
Write to your clipboard
clipboardWrite
See the address and title of every tab you have open
tabs
Store data in your browser
storage