Is GreenGuard - Adblocker safe?

Medium risk

GreenGuard redirects visits to some merchant sites through affiliate tracking links.

When a tab finishes loading on a hardcoded merchant domain, GreenGuard checks for a throttle cookie and can replace the page URL with an affiliate deep link. The affected destinations include affiliate networks used for merchants such as AliExpress, Nike, and Lexa.nl.

GreenGuardv0.2.95Chrome Web Store
50Risk
Who publishes it

Ody - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
GreenGuard
Declared legal entity
Ody
Registered address
Galileïlaan 33Q, Ereprijs, Ede 6718BP, NL
Registered contact
B. Verkruijssen

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

GreenGuard reroutes shopping visits through its own affiliate links

GreenGuard's background worker matches the site you open against a hardcoded 2,737-merchant list and replaces the tab URL with its own affiliate link.

We observed an AliExpress visit rerouted and re-tagged with the extension's partner ID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a tab on a shopping site the extension knows about.

The site has to be one of 2,737 hosts listed inside the extension, such as aliexpress.com, nike.com or hema.nl.

The extension did this

The extension replaces the address in that tab with its own affiliate link, which bounces you back to the same shop carrying its partner ID.

The address you typed is discarded rather than kept, so anything already in the link, including another site's referral tag, does not survive.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_c3ogHasr&cn=7630&af=277002&cv=greenguard&afref=&dp=48an0294ecq3leae0sn5oqwr&dl_target_url=https://www.aliexpress.com/

HTTP 302 onward to www.aliexpress.com carrying af=277002, cv=greenguard and an aff_fcid tracking value.

Identifiers the redirect attaches to your shopping visit
  • GreenGuard's AWIN publisher ID
    id=451975

    Marks the visit as sent by this extension so the shop credits it for anything you buy.

  • GreenGuard's daisycon ID
    wi=277002

    The same crediting role on a different affiliate network, used for most of the listed shops.

  • GreenGuard's tradetracker ID
    a=277764

    The crediting ID used for the Dutch shops routed through tradetracker.

  • The address you actually asked for
    r=&u= (both empty in the deep link)

    The link you opened is thrown away rather than passed along, so any referral tag already on it is lost.

  • The repeat gate cookie
    aliexpress= (secure, httpOnly, expires in 24h)

    A one-day cookie written on the shop's own domain, named after the shop, that stops the redirect happening again today.

The code that does this

The navigation listener and the redirect, as shipped

Readable version

The tab listeners and the redirect, renamed

// getCookie / setCookie: thin wrappers over the chrome.cookies APIconst getCookie = async (q) => (chrome.cookies ? await chrome.cookies.get(q) : null);const setCookie = async (c) => {  if (c) {    await chrome.cookies.set(c);    console.log("Successfully saved cookie with url: " + c.url);  }};// redirectThroughAffiliate(tabId, deepLink, host, changeInfo)// Fires at most once per merchant host per 24 hours, gated by a cookie the// extension writes onto the merchant's own domain.async function redirectThroughAffiliate(tabId, deepLink, host, changeInfo) {  const throttleQuery = {    name: host.substring(0, host.lastIndexOf(".")), // e.g. "aliexpress"    url: `https://${host}`  };  if (await getCookie(throttleQuery) === null && changeInfo.status === "complete") {    const throttleCookie = {      url: `https://${host}`,      expirationDate: new Date().getTime() / 1e3 + 86400, // 24 hours      name: host.substring(0, host.lastIndexOf(".")),      httpOnly: true,      secure: true    };    await setCookie(throttleCookie);    // Replaces the WHOLE tab URL. The page the user asked for is discarded.    await chrome.tabs.update(tabId, { url: deepLink });    console.log(`redirected on ${host}`);  } else {    console.log("Cookie already exist and deepLink redirected try again in 24 hrs or changeInfo status not yet complete");  }}// matchMerchant(tabId, url, changeInfo)// MERCHANT_TABLE is the hardcoded 2,737-entry list of host -> deepLink pairs.function matchMerchant(tabId, url, changeInfo) {  const parsed = new ParsedUrl(url);  let bareHost;  if (parsed.host.includes("www")) bareHost = parsed.host.replace(/^www\./, "");  MERCHANT_TABLE.forEach(entry => {    if (entry.host === bareHost) redirectThroughAffiliate(tabId, entry.deepLink, bareHost, changeInfo);  });}// Registered unconditionally at service-worker start; no setting gates them.chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {  if (chrome.runtime.lastError) console.log("[Error]: ", chrome.runtime.lastError.message);  if (tabId && tab.url) matchMerchant(tabId, tab.url, changeInfo);});chrome.tabs.onCreated.addListener(tab => {  if (chrome.runtime.lastError) console.log("[Error]: ", chrome.runtime.lastError.message);  if (tab.id && tab.url) matchMerchant(tab.id, tab.url, { status: tab.status });});

The merchant table shape

const MERCHANT_TABLE_SAMPLE = [  { _id: "aliexpress.com", host: "aliexpress.com",    deepLink: "https://www.awin1.com/awclick.php?mid=10748&id=451975&pref1=greengaurd",    affiliatePartner: "AWIN" },  { _id: "nike.com", host: "nike.com",    deepLink: "https://www.awin1.com/awclick.php?mid=16332&id=451975&pref1=greengaurd",    affiliatePartner: "AWIN" },  { _id: "zoveilig.nl", host: "zoveilig.nl",    deepLink: "https://tc.tradetracker.net/?c=25832&m=0&a=277764&r=&u=&cid=greengaurd",    affiliatePartner: "tradetracker" },  { _id: "zwangerenkids.nl", host: "zwangerenkids.nl",    deepLink: "https://zwangerenkids.nl/website/Includes/TradeTracker/?tt=7851_0_277764_&r=&cid=greengaurd",    affiliatePartner: "tradetracker" }];// 2,737 rows total: 146 AWIN, 2,000 daisycon, 591 tradetracker.// Note r= and u= are empty on the tradetracker links: the URL you asked for// is never forwarded to the deep link, so it is discarded, not appended to.
When this fires

Every 1 day

The redirect fires the first time you reach a listed shop, then holds off on that shop for a day. It is not once per browser session: each of the 2,737 shops carries its own day-long gate, so a normal week of shopping can be rerouted many times.

Where the rerouted navigation goes before it reaches the shop
    • awin1.com

    AWIN affiliate network. Records the click against publisher ID 451975 for 146 of the listed merchants.

    • ds1.nl

    Daisycon click host. Records the click against ID 277002 for around 2,000 of the listed merchants.

    • tc.tradetracker.net

    TradeTracker click host. Records the click against ID 277764 for 591 mostly Dutch merchants.

    • s.click.aliexpress.com

    AliExpress own affiliate deep-link handler, reached at the end of the daisycon hop, which stamps the partner IDs onto the landing page.

    • lt45.net
    • rkn3.net

    Additional daisycon click host used by some rows of the merchant table.

What it can do

Permissions this extension asks for, as declared in version 0.2.95. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See every page you navigate to, as you navigate to it

    webNavigation

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Watch every request your browser makes

    webRequest

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed GreenGuard - Adblocker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.awin1.com

    GreenGuard - Adblocker sends data to www.awin1.com. 4 other extensions we have analysed send data here.

  • ds1.nl

    GreenGuard - Adblocker sends data to ds1.nl. No other extension we have analysed sends data here.

  • lt45.net

    GreenGuard - Adblocker sends data to lt45.net. No other extension we have analysed sends data here.

  • rkn3.net

    GreenGuard - Adblocker sends data to rkn3.net. No other extension we have analysed sends data here.

  • tc.tradetracker.net

    GreenGuard - Adblocker sends data to tc.tradetracker.net. No other extension we have analysed sends data here.

Updated 30 September 2026fliaeldfhoeeihjdigndekeoicjghgje