Is GreenGuard - Adblocker safe?
GreenGuard redirects visits to some merchant sites through affiliate tracking links.
When a tab finishes loading on a hardcoded merchant domain, GreenGuard checks for a throttle cookie and can replace the page URL with an affiliate deep link. The affected destinations include affiliate networks used for merchants such as AliExpress, Nike, and Lexa.nl.
Who publishes itOdy - no other listings under this identity
Ody - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
GreenGuard reroutes shopping visits through its own affiliate links
GreenGuard's background worker matches the site you open against a hardcoded 2,737-merchant list and replaces the tab URL with its own affiliate link.
We observed an AliExpress visit rerouted and re-tagged with the extension's partner ID.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a tab on a shopping site the extension knows about.
The site has to be one of 2,737 hosts listed inside the extension, such as aliexpress.com, nike.com or hema.nl.
The extension replaces the address in that tab with its own affiliate link, which bounces you back to the same shop carrying its partner ID.
The address you typed is discarded rather than kept, so anything already in the link, including another site's referral tag, does not survive.
HTTP 302 onward to www.aliexpress.com carrying af=277002, cv=greenguard and an aff_fcid tracking value.
- GreenGuard's AWIN publisher IDid=451975
Marks the visit as sent by this extension so the shop credits it for anything you buy.
- GreenGuard's daisycon IDwi=277002
The same crediting role on a different affiliate network, used for most of the listed shops.
- GreenGuard's tradetracker IDa=277764
The crediting ID used for the Dutch shops routed through tradetracker.
- The address you actually asked forr=&u= (both empty in the deep link)
The link you opened is thrown away rather than passed along, so any referral tag already on it is lost.
- The repeat gate cookiealiexpress= (secure, httpOnly, expires in 24h)
A one-day cookie written on the shop's own domain, named after the shop, that stops the redirect happening again today.
The navigation listener and the redirect, as shipped
The tab listeners and the redirect, renamed
// getCookie / setCookie: thin wrappers over the chrome.cookies APIconst getCookie = async (q) => (chrome.cookies ? await chrome.cookies.get(q) : null);const setCookie = async (c) => { if (c) { await chrome.cookies.set(c); console.log("Successfully saved cookie with url: " + c.url); }};// redirectThroughAffiliate(tabId, deepLink, host, changeInfo)// Fires at most once per merchant host per 24 hours, gated by a cookie the// extension writes onto the merchant's own domain.async function redirectThroughAffiliate(tabId, deepLink, host, changeInfo) { const throttleQuery = { name: host.substring(0, host.lastIndexOf(".")), // e.g. "aliexpress" url: `https://${host}` }; if (await getCookie(throttleQuery) === null && changeInfo.status === "complete") { const throttleCookie = { url: `https://${host}`, expirationDate: new Date().getTime() / 1e3 + 86400, // 24 hours name: host.substring(0, host.lastIndexOf(".")), httpOnly: true, secure: true }; await setCookie(throttleCookie); // Replaces the WHOLE tab URL. The page the user asked for is discarded. await chrome.tabs.update(tabId, { url: deepLink }); console.log(`redirected on ${host}`); } else { console.log("Cookie already exist and deepLink redirected try again in 24 hrs or changeInfo status not yet complete"); }}// matchMerchant(tabId, url, changeInfo)// MERCHANT_TABLE is the hardcoded 2,737-entry list of host -> deepLink pairs.function matchMerchant(tabId, url, changeInfo) { const parsed = new ParsedUrl(url); let bareHost; if (parsed.host.includes("www")) bareHost = parsed.host.replace(/^www\./, ""); MERCHANT_TABLE.forEach(entry => { if (entry.host === bareHost) redirectThroughAffiliate(tabId, entry.deepLink, bareHost, changeInfo); });}// Registered unconditionally at service-worker start; no setting gates them.chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => { if (chrome.runtime.lastError) console.log("[Error]: ", chrome.runtime.lastError.message); if (tabId && tab.url) matchMerchant(tabId, tab.url, changeInfo);});chrome.tabs.onCreated.addListener(tab => { if (chrome.runtime.lastError) console.log("[Error]: ", chrome.runtime.lastError.message); if (tab.id && tab.url) matchMerchant(tab.id, tab.url, { status: tab.status });});The merchant table shape
const MERCHANT_TABLE_SAMPLE = [ { _id: "aliexpress.com", host: "aliexpress.com", deepLink: "https://www.awin1.com/awclick.php?mid=10748&id=451975&pref1=greengaurd", affiliatePartner: "AWIN" }, { _id: "nike.com", host: "nike.com", deepLink: "https://www.awin1.com/awclick.php?mid=16332&id=451975&pref1=greengaurd", affiliatePartner: "AWIN" }, { _id: "zoveilig.nl", host: "zoveilig.nl", deepLink: "https://tc.tradetracker.net/?c=25832&m=0&a=277764&r=&u=&cid=greengaurd", affiliatePartner: "tradetracker" }, { _id: "zwangerenkids.nl", host: "zwangerenkids.nl", deepLink: "https://zwangerenkids.nl/website/Includes/TradeTracker/?tt=7851_0_277764_&r=&cid=greengaurd", affiliatePartner: "tradetracker" }];// 2,737 rows total: 146 AWIN, 2,000 daisycon, 591 tradetracker.// Note r= and u= are empty on the tradetracker links: the URL you asked for// is never forwarded to the deep link, so it is discarded, not appended to.Every 1 day
The redirect fires the first time you reach a listed shop, then holds off on that shop for a day. It is not once per browser session: each of the 2,737 shops carries its own day-long gate, so a normal week of shopping can be rerouted many times.
- awin1.com
AWIN affiliate network. Records the click against publisher ID 451975 for 146 of the listed merchants.
- ds1.nl
Daisycon click host. Records the click against ID 277002 for around 2,000 of the listed merchants.
- tc.tradetracker.net
TradeTracker click host. Records the click against ID 277764 for 591 mostly Dutch merchants.
- s.click.aliexpress.com
AliExpress own affiliate deep-link handler, reached at the end of the daisycon hop, which stamps the partner IDs onto the landing page.
- lt45.net
- rkn3.net
Additional daisycon click host used by some rows of the merchant table.
What it can do
Permissions this extension asks for, as declared in version 0.2.95. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Read and change your data on every secure site you visit
https://*/*
See every page you navigate to, as you navigate to it
webNavigation
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Watch every request your browser makes
webRequest
Block and redirect the requests your browser makes
declarativeNetRequest
See which of your requests its blocking rules matched
declarativeNetRequestFeedback
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed GreenGuard - Adblocker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.awin1.com
GreenGuard - Adblocker sends data to www.awin1.com. 4 other extensions we have analysed send data here.
- ds1.nl
GreenGuard - Adblocker sends data to ds1.nl. No other extension we have analysed sends data here.
- lt45.net
GreenGuard - Adblocker sends data to lt45.net. No other extension we have analysed sends data here.
- rkn3.net
GreenGuard - Adblocker sends data to rkn3.net. No other extension we have analysed sends data here.
- tc.tradetracker.net
GreenGuard - Adblocker sends data to tc.tradetracker.net. No other extension we have analysed sends data here.