Is Fake news debunker InVID WeVerify VeraAI safe?

Medium risk

InVID WeVerify is medium risk. Choosing context-menu tools like OCR, Magnifier, or Forensic makes the background code place the selected image or link URL into a Matomo event label, posted to analytics.verification-plugin.eu without the popup's analytics check.

invid.project.euv0.93Chrome Web Store
45Risk
Who publishes it

CERTH-ITI - no other listings under this identity, 5 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
invid.project.eu
Declared legal entity
CERTH-ITI
Registered address
6th Km Charilaou-Thermi Road, Thessaloniki 57001, Greece
Registered contact
Vasileios Mezaris

Shared hosts - 5 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

archiveweb.page
Also called by 1 other listing: Webrecorder ArchiveWeb.page
netpreserve.org
Also called by 1 other listing: Webrecorder ArchiveWeb.page
view.genial.ly
Also called by 1 other listing: ClassInTheBox
hiya.com
Also called by 2 other listings, including ReplyWise: AI Comment Generator
replayweb.page
Also called by 2 other listings, including Webrecorder ArchiveWeb.page

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Context-menu URLs sent to Matomo without analytics preference gate

Choosing context-menu tools like OCR, Magnifier, or Forensic makes the background code place the selected image or link URL into a Matomo event label, posted to analytics.verification-plugin.eu without the popup's analytics check.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You choose a verification tool from the browser context menu.

The relevant handlers include OCR, Magnifier, Forensic, Analysis, Assistant, and YouTube thumbnails.

The extension did this

The extension sends the selected URL as the label of an analytics event.

The background service worker calls the analytics helper directly from the context-menu handler.

Fields the background analytics call constructs
  • Event category
    contextMenu

    Shows that the event came from a context-menu action rather than a normal page view.

  • Event action
    contextMenuClick

    Shows that the analytics event records a context-menu click.

  • Chosen tool
    Forensic

    Shows which verification tool you selected for the URL.

  • Selected URL
    https://news.example.org/photos/2026/election-rally.jpg (illustrative)

    Can reveal the image, link, or page you asked the extension to analyze.

Captured request
POSThttps://analytics.verification-plugin.eu/matomo.php

No Matomo request body was recorded during dynamic analysis; the POST method, URL, header, and form fields are constructed in the shipped background code.

Headers
Content-Type
application/x-www-form-urlencoded
The code that does this

Background context-menu path that builds the Matomo event

Readable version

Deobfuscated Matomo helper and event wrapper

background.js
function pt(e) {  if (e === void 0) {    console.error(`[matomoCall][Error] undefined parameter`);    return  }  let t, n;  typeof window < `u` && ({    innerWidth: t,    innerHeight: n  } = ft());  let r = new URLSearchParams;  r.append(`idsite`, dt), r.append(`rec`, 1), r.append(`apiv`, 1), r.append(`action_name`, e.action_name), r.append(`url`, e.url), r.append(`_id`, e.client_id), r.append(`_cvar`, JSON.stringify(e.cvar)), e.event && (r.append(`e_c`, e.event.e_c), r.append(`e_a`, e.event.e_a), r.append(`e_n`, e.event.e_n)), e.uid && r.append(`uid`, e.uid), r.append(`cookie`, 1), t && n && r.append(`res`, t + `x` + n), fetch(`https://analytics.verification-plugin.eu/matomo.php`, {    method: `POST`,    headers: {      "Content-Type": `application/x-www-form-urlencoded`    },    body: r  })}var mt = (e, t, n, r, i, a = null, o = ``) => {    let s = a && a.location ? a.location.pathname : null,      c;    c = o ? {      action_name: s,      client_id: i,      uid: o,      url: r,      event: {        e_c: e,        e_a: t,        e_n: n      }    } : {      action_name: s,      client_id: i,      url: r,      event: {        e_c: e,        e_a: t,        e_n: n      }    }, pt(c)  }

Deobfuscated URL selector

background.js
Tt = e => {  if (typeof e == `string` && e.startsWith(`http`)) return e;  let t = e.pageUrl;  return e.mediaType === `image` ? e.srcUrl : t}

Deobfuscated context-menu handlers

background.js
let t = `popup.html`,  n = e => {    let n = Tt(e);    n !== `` && (gt({      url: t + `#/app/assistant/` + encodeURIComponent(n)    }), mt(`contextMenu`, `contextMenuClick`, `Assistant`, n, ``))  },  r = e => {    let n = Tt(e);    n !== `` && (gt({      url: t + `#/app/tools/ocr/` + encodeURIComponent(n)    }), mt(`contextMenu`, `contextMenuClick`, `OCR`, n, ``))  },  i = e => {    let n = e.linkUrl;    n !== `` && n.startsWith(`http`) && (gt({      url: t + `#/app/tools/thumbnails/` + encodeURIComponent(n)    }), mt(`contextMenu`, `contextMenuClick`, `YouTubeThumbnails`, n, ``))  },  a = e => {    let n = e.linkUrl;    n !== `` && (gt({      url: t + `#/app/tools/Analysis/` + encodeURIComponent(n)    }), mt(`contextMenu`, `contextMenuClick`, `Analysis`, n, ``))  },  o = e => {    let n = Tt(e);    n !== `` && (gt({      url: t + `#/app/tools/magnifier/` + encodeURIComponent(n)    }), mt(`contextMenu`, `contextMenuClick`, `Magnifier`, n, ``))  },  s = e => {    let n = Tt(e);    n !== `` && (gt({      url: t + `#/app/tools/forensic/` + encodeURIComponent(n)    }), mt(`contextMenu`, `contextMenuClick`, `Forensic`, n, ``))  }
Analytics destination
    • analytics.verification-plugin.eu

    Receives the Matomo analytics POST built by the background context-menu handlers, including the selected URL as event data.

Updated 30 September 2026mhccpoafgdgbhnjfhkcmgknndkeenfhe