Is Homer (formerly KoalaData) – Property Search Extension safe?
Homer sends real-estate listing pages, search URLs, listing IDs, and page-view analytics to its APIs.
On Domain and Realestate.com.au pages, Homer reads the current page URL and listing information, and for listing pages it sends the page HTML to its scraper API. It also sends search-result listing IDs and price filters to Homer, and records matching page views with URLs and page titles through PostHog.
Who publishes itNo other listings under this identity
No other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Homer sends the page URL of every Domain and REA listing you view to PostHog
We observed Homer send the full URL of every Domain.com.au or realestate.com.au listing and search page you open to PostHog, a third-party analytics service, on each navigation.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a listing or search page on Domain.com.au or realestate.com.au while Homer is installed.
No sign-in or interaction with Homer's own UI is required, just loading the page.
Homer sends that page's full URL to PostHog, a third-party analytics company.
This happens on every matching page load, without a consent prompt.
Observed during dynamic analysis: navigating to a Domain.com.au listing page produced a gzip-compressed PostHog request carrying this event. Shown above is the decompressed equivalent of one event from that batch.
{ "event": "extension_listing_page_viewed", "properties": { "$current_url": "https://www.domain.com.au/1-39-oxley-road-hawthorn-vic-3122-2021104096", "$host": "www.domain.com.au", "$pathname": "/1-39-oxley-road-hawthorn-vic-3122-2021104096", "extension_version": "1.1.16", "source": "chrome_extension" }}Content script reports the page, background worker forwards it to PostHog
Readable: page classification and message send
content/injectListing.jsfunction trackPageView(currentUrl = window.location.href) { if (isDomainSearchUrl(currentUrl) || isReaSearchUrl(currentUrl)) { trackPageViewOncePerUrl(currentUrl, extensionSearchPageViewed()); return; } if (isDomainListingUrl(currentUrl) || isReaListingUrl(currentUrl)) { trackPageViewOncePerUrl(currentUrl, extensionListingPageViewed()); }}function sendPostHogEventToBackground(event, pageUrl = getHostPageUrl()) { if (!isExtensionContextValid()) return; try { chrome.runtime.sendMessage({ event: event.event, pageUrl: pageUrl, properties: event.properties, type: "POSTHOG_EVENT" }); } catch {}}Readable: background forwards the URL fields to PostHog
background.jsfunction extractUrlProperties(pageUrl) { const url = new URL(pageUrl); return { $current_url: `${url.origin}${url.pathname}`, $host: url.host, $pathname: url.pathname };}function forwardToPostHog(event, options) { if (!posthogClient) return; const properties = { ...event.properties }; if (options?.pageUrl) { Object.assign(properties, extractUrlProperties(options.pageUrl)); } posthogClient.capture(event.event, properties);}- Full page URLhttps://www.domain.com.au/1-39-oxley-road-hawthorn-vic-3122-2021104096
The exact listing or search page you were viewing, including the property address in the path.
- Site hostwww.domain.com.au
Which of the two property sites you were browsing.
- Page path/1-39-oxley-road-hawthorn-vic-3122-2021104096
The URL path, duplicated from the full URL for PostHog's own filtering.
- Extension version1.1.16
Which Homer version sent the event, registered on every event by the analytics client.
- us.i.posthog.com
PostHog, a third-party product-analytics provider used by Homer's developer. Receives the page URL, host, and path from every matching page view.
Where it sends data
Destinations our analysis observed Homer (formerly KoalaData) – Property Search Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- us.i.posthog.com
Homer (formerly KoalaData) – Property Search Extension sends data to us.i.posthog.com. 24 other extensions we have analysed send data here.
- api.homerapp.com.au
Homer (formerly KoalaData) – Property Search Extension sends data to api.homerapp.com.au. No other extension we have analysed sends data here.
- scraper-api-282093085091.australia-southeast1.run.app
Homer (formerly KoalaData) – Property Search Extension sends data to scraper-api-282093085091.australia-southeast1.run.app. No other extension we have analysed sends data here.