Is Flash Player Extension For Web safe?

Medium risk

Flash Player Extension For Web sends page URLs and device/IP details to an Aliyun log endpoint.

On HTTP and HTTPS pages, the extension can send the current page URL to its background script through a content-script DOM marker. The background script adds a persistent extension UUID, install time, IP geolocation details, OS, browser, and language metadata, then posts the record to Aliyun's logging service.

Allen Alexisv1.0.1Chrome Web Store
47Risk
Who publishes it

Allen Alexis - 3 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Allen Alexis

Same store account

3 other listings published from this account, 141k+ users between them. 2 of them carry a finding.

bilibili video downloader90k+HighUniversal Copy-Enable Copy50k+MediumChatSider:Free ChatGPT Assistant(GPT4)1k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Page clicks can send visited URLs with device identifiers to Aliyun logs

Browsing an HTTP or HTTPS page can trigger the extension to report the page URL to hawkeye-us.us-west-1.log.aliyuncs.com/logstores/flash_player/track, along with your IP address and stored data including a persistent UUID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user browses an HTTP or HTTPS page where a page-level click can activate the extension-created element.

The extension did this

The extension sends the active page URL with a persistent UUID, IP information, country, browser, operating system, and language to its Aliyun log endpoint.

Captured request
POSThawkeye-us.us-west-1.log.aliyuncs.com/logstores/flash_player/track
Fields in the request
  • Current page URL
    https://example.com/account (illustrative)

    Shows which web page was active when the extension telemetry was triggered.

  • IP address
    203.0.113.24 (illustrative)

    Links the telemetry event to network location information collected by the extension.

  • Extension storage data
    d7f3a1b2-4c6d-4f90-8a21-3b7c2e0a9f11 (illustrative)

    Includes stored values such as a persistent UUID that can connect multiple telemetry events from the same browser profile.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Flash Player Extension For Web contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ip-api.comwidely used

    Flash Player Extension For Web sends data to ip-api.com. A widely used service: 62 other extensions we have analysed send data here.

  • ipinfo.iowidely used

    Flash Player Extension For Web sends data to ipinfo.io. A widely used service: 45 other extensions we have analysed send data here.

  • hawkeye-us.us-west-1.log.aliyuncs.com

    Flash Player Extension For Web sends data to hawkeye-us.us-west-1.log.aliyuncs.com. 18 other extensions we have analysed send data here.

Updated 30 September 2026pkomojeklgbndilokjedodpebdbekiod