Is ima知识库 safe?
ima知识库 is medium risk. Dynamic analysis captured POSTs to ima.qq.com with the full visited-page URL, fired by the service worker on each tab navigation while logged into QQ/IMA. The body carries the URL in web_info.source_path, on any site, not just saved pages.…
Who publishes it深圳市腾讯计算机系统有限公司 - no other listings under this identity
深圳市腾讯计算机系统有限公司 - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Visited URLs POSTed to ima.qq.com on Every Navigation (Login-Gated)
Dynamic analysis captured POSTs to ima.qq.com with the full visited-page URL, fired by the service worker on each tab navigation while logged into QQ/IMA.
The body carries the URL in web_info.source_path, on any site, not just saved pages.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate to any page while logged in to your IMA (QQ) account.
Applies to any HTTP or HTTPS URL, not limited to pages you have saved.
The extension posts the URL to ima.qq.com to check whether you have already saved it.
This fires on every tab navigation and on tab activation, before you interact with the extension popup.
- content-type
- application/json
{ "media_type": 2, "web_info": { "source_path": "https://www.google.com/" }}- Page you are visitinghttps://www.google.com/
The full URL of every page you load, sent to Tencent's ima.qq.com servers.
- Media type2
A numeric code indicating content type (2 = web page). Sent with every request.
Service-worker code that fires the URL check on every navigation.
Navigation subscriber
// Fires on every webNavigation.onCommitted eventiD.subscribe(({ url, tabId }) => { collectManager.onUrlChanged(url, tabId); // triggers URL POST chrome.action.setPopup({ popup: '', tabId });});onUrlChanged — invokes server check for every visited URL
// Called on every navigation while user is logged inasync onUrlChanged(url, tabId) { if (!url) return Status.Error; if (!await this.accountService.checkIsLogin()) return Status.NotCollectable; // login gate // ... cache check ... const collectInfo = await this.getCollectInfo(url, tabId, FetchMode.GiveUpIfTokenExpired); // getCollectInfo → checkMediaInKnowledgeBase → checkContentStatusInKnowledgeBase → POST return collectInfo ? collectInfo.collectStatus : Status.NotCollectable;}The POST call that transmits the visited URL
// Sends the visited URL to ima.qq.comasync checkContentStatusInKnowledgeBase(mediaInfo, fetchMode) { const response = await this.fetchService.post( `${this.urlPrefix}/check_content_status_in_knowledge_base`, { json: serialize(mediaInfo), [FetchManner]: fetchMode } // mediaInfo contains web_info.source_path = visited URL ); return deserialize(response);}- ima.qq.com
Tencent QQ's IMA knowledge-base API. Receives the full URL of every page visited by a logged-in user to return saved/unsaved status.
Identifiable Telemetry Sent to galileotelemetry.tencent.com on Every Event
Dynamic analysis captured 64 POSTs to galileotelemetry.tencent.com in a 3-min session, each with a device GUID, QQ uid, and user-agent, on every log event: navigation, errors, UI actions, tying a timestamped stream to one device.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate to a page, encounter an error, or interact with the extension UI.
Telemetry fires for any log-level event in the service worker.
The extension sends a JSON payload to galileotelemetry.tencent.com containing your QQ user ID, a persistent device GUID, and your browser user-agent string.
Our dynamic analysis recorded 64 such POST requests during a 3-minute session.
- content-type
- text/plain;charset=UTF-8
{ "topic": "SDK-707f4fe221a6cdf8afe5", "data": [ { "message": "{\"msg\":\"[background]: collect background started\",\"level\":\"info\"}", "fields": "{\"app_id\":\"ima-universal-collect\",\"js_version\":\"1.4.0\",\"uid\":\"<planted marker value>\",\"q36\":\"ABCDEF1234567890\",\"guid\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"qua\":\"Mozilla/5.0 (X11; Linux x86_64) Chrome/128.0.0.0\",\"id\":\"SDK-707f4fe221a6cdf8afe5\",\"env\":\"production\"}", "timestamp": 1749225418173 } ]}- Your QQ user ID<planted marker value>
Your account identifier for the QQ/IMA platform, included in every telemetry payload.
- Device GUIDa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
A 32-char random ID generated on first install, stored locally. Persists across restarts, linking all activity on this device.
- Browser user-agent stringMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/128.0.0.0
Your browser version, operating system, and architecture, contributes to fingerprinting.
- App and SDK identifiersima-universal-collect / SDK-707f4fe221a6cdf8afe5
Hardcoded values identifying the extension build and SDK topic to the telemetry server.
- Extension version1.4.0
The installed version of the extension, sent with every payload.
The telemetry logger and its initialization in the service worker.
BackgroundLoggerPolyfill — every log event includes uid, guid, qua
const GALILEO_URL = 'https://galileotelemetry.tencent.com/collect';const SDK_TOPIC = 'SDK-707f4fe221a6cdf8afe5';class BackgroundLoggerPolyfill { constructor() { this.baseConfig = {}; } setLoggerConfig(fields) { this.baseConfig = { ...this.baseConfig, ...fields }; } getCommonFields() { return JSON.stringify({ ...this.baseConfig, id: SDK_TOPIC, env: 'production' }); // baseConfig contains uid, guid, qua, q36, app_id, js_version } async report(serialisedPayload) { const headers = new Headers(); headers.set('content-type', 'text/plain;charset=UTF-8'); await fetch(GALILEO_URL, { method: 'POST', headers, body: serialisedPayload }); }}Initialization: loads user ID, device GUID, and user-agent into every future telemetry call
// On service worker startup, load identifiers into the shared loggerlogger.setLoggerConfig({ app_id: 'ima-universal-collect', js_version: manifest.version });getAccountInfo().then(account => { logger.setLoggerConfig({ uid: account?.userId }); // QQ user ID});getDeviceConfig().then(config => { logger.setLoggerConfig({ q36: config?.q36 ?? '', // QQ platform device ID guid: config?.guid ?? '', // persistent install GUID qua: config?.qua ?? '', // user-agent string });});- galileotelemetry.tencent.com
Tencent's first-party telemetry collection service. Receives event logs keyed to QQ user ID and persistent device GUID from every IMA extension install.