Is Google Analytics UTILS safe?

Medium risk

Google Analytics UTILS sends the active tab domain and a _ga cookie-derived client ID to Amplitude.

When the popup opens or controls are clicked, it reads the active tab hostname and looks for a _ga cookie on that site. It posts analytics events to api2.amplitude.com with that domain plus the derived Google Analytics client ID, or a generated fallback if no cookie exists.

Luraticv0.5Chrome Web Store
49Risk
Who publishes it

Luratic - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Luratic
Declared legal entity
Luratic
Registered address
Atlantic Sea, A Coruña, La Coruña 15001, ES
Registered contact
Luratic

Same store account

1 other listing published from this account, 2k+ users between them, none of them carrying a finding.

GA4 Enhanced DebugView by Luratic2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup telemetry sends the active tab domain and _ga client ID to Amplitude.

Opening the Google Analytics UTILS popup or using its controls sends telemetry to Amplitude, including the active tab's domain and a user ID from that site's _ga cookie, or a generated fallback if unavailable.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the popup or changes extension controls.

The extension did this

The extension sends the active tab domain and a _ga cookie-derived user ID to Amplitude telemetry.

Captured request
POSThttps://api2.amplitude.com/2/httpapi
Fields in the request
  • Active tab domain
    example.com (illustrative)

    Identifies which site was open when the popup telemetry ran.

  • Site _ga client ID
    1234567890.1712345678 (illustrative)

    Links the request to a Google Analytics client identifier stored in the site's cookie.

What it can do

Permissions this extension asks for, as declared in version 0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed Google Analytics UTILS contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api2.amplitude.comwidely used

    Google Analytics UTILS sends data to api2.amplitude.com. A widely used service: 41 other extensions we have analysed send data here.

Updated 30 September 2026dmhoedahbmlaipacpamhefgjoiebamjm