Is Image Search safe?
Image Search injects every site and sends referrer data and Ethereum-provider presence to Mixpanel.
On every page, Image Search adds an extension iframe and runs a page script that checks whether window.ethereum exists. The iframe initializes Mixpanel with Do Not Track ignored and forwards that result to api-js.mixpanel.com, while the bundled Mixpanel library includes the page referrer/referring domain plus standard browser, screen, and IP-derived properties.
Who publishes itIndividual - no other listings under this identity
Individual - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Image Search sends your page referrer and wallet status to Mixpanel every visit
On every website you open, Image Search injects an off-screen iframe that checks whether a crypto wallet extension is installed and sends that result, plus the page you were on and your IP address, to Mixpanel with no consent prompt.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any website with Image Search installed.
No click or interaction with the extension icon is needed.
The extension injects an off-screen iframe into the page, checks for a crypto wallet, and reports the result to Mixpanel.
The request fires within seconds of the page finishing its load.
- The page you were onhttps://www.example.com/news/markets-update
The page you were on is read as the iframe's referrer and sent with every event, tying tracking data to that site.
- Whether you have a crypto walletethereum: true
The extension tests for a MetaMask-style wallet provider in your browser and reports whether one is present.
- Your IP address203.0.113.44 (resolved from the request)
A server-side IP capture flag on the request lets Mixpanel resolve and store the request's origin IP address.
- Browser and screen detailsChrome 128 on Windows, 1920x1080
Mixpanel's default properties add your browser, operating system, and screen size to every event.
HTTP 200; Mixpanel's standard track acknowledgement.
data=%7B%22event%22%3A%22Message%22%2C%22properties%22%3A%7B%22token%22%3A%224b7d89952ee9736362138b2a3c23e497%22%2C%22ethereum%22%3Atrue%2C%22%24referrer%22%3A%22https%3A%2F%2Fwww.example.com%2Fnews%2Fmarkets-update%22%2C%22%24current_url%22%3A%22chrome-extension%3A%2F%2Fcnafldpjebmpkibjdogkhifhnljdifae%2Fcontent%2Finject.html%22%2C%22mp_lib%22%3A%22web%22%2C%22%24lib_version%22%3A%222.43.0%22%7D%7D&verbose=1&ip=1The wallet check and the Mixpanel wiring
check.js, annotated
scripts/check.js// Runs inside the actual web page, not the extension's iframelet ethereumDetected = "undefined" !== typeof window.ethereum; // true if a wallet provider is presentlet serviceIframe = document.getElementById("is-service-frame");// Hands the wallet flag to the off-screen iframe over postMessageserviceIframe.contentWindow.postMessage({id: "is-service", message: {ethereum: ethereumDetected}}, "*");mixpanel-init.js, annotated
scripts/mixpanel-init.js// Hardcoded Mixpanel project token, ignore_dnt:true means Do Not Track is not honoredmixpanel.init('4b7d89952ee9736362138b2a3c23e497', {debug: true, ignore_dnt: true});// Any {id: "is-service"} message from the page-side script is forwarded// straight to Mixpanel as a 'Message' event, unfilteredasync function onMessage(e) { if (!e.data.id || e.data.id !== "is-service") { return; } let message = e.data.message; mixpanel.track('Message', message);}console.debug("Listening to content script messages inside iframe");window.onmessage = onMessage;- api-js.mixpanel.com
Mixpanel's event-collection endpoint, operated by Mixpanel Inc. Receives the wallet-detection flag, page referrer, and IP address from every page load through this extension.
What it can do
Permissions this extension asks for, as declared in version 3.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Image Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api-js.mixpanel.comwidely used
Image Search sends data to api-js.mixpanel.com. A widely used service: 47 other extensions we have analysed send data here.