Is 福橘-股票行情 safe?

Medium risk

福橘-股票行情 sends the address of every page you visit to plug2025.bm-com.com with a persistent user ID.

This stock-quote extension runs on all websites and, on every page load, sends the page's host and full URL to its own server. Each report carries a persistent user ID and session ID stored in the browser, so visits can be linked over time. It does not limit this to finance sites and asks for no consent.

mikertanv2.0.0Chrome Web Store
49Risk
Who publishes it

mikertan - 6 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
mikertan

Same store account

6 other listings published from this account, 5k+ users between them. 3 of them carry a finding.

界图-图片批量下载2k+LowGoingMed1k+Low红鸟-X/推特下载助手945Medium三赞-抖音直播增强助手308Medium希蛙 · 希音图片下载 shein image download304LowSiteShield:Block Site, Stay Focused18Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

plug2025.bm-com.com
Also called by 4 other listings, including 云链 - Tiktok视频下载, 阿蛙 · 阿里巴巴1688商品图下载助手

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Stock-quote extension sends every page URL you visit to its own server

Code analysis shows a script on every page sends the page's host and full URL to plug2025.bm-com.com with a persistent session ID.

No filtering to finance sites applies.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You load any webpage, including sites unrelated to stock quotes.

The extension did this

The extension sends the page host and full URL to its own server, tagged with a persistent session ID.

The code that does this

Content script message and the background function that reports it

Readable version

search.js sends host and URL on every page

js/search.js
chrome.runtime.sendMessage({  type: "recordVisitor",  fromChannel: "content",  host: window.location.host,  url: window.location.href});

background.js onMessage dispatch

js/background.js
"recordVisitor" == o.type && recordVisitor(o.fromChannel, o.host, o.url)

recordVisitor() builds and sends the report

js/background.js
function recordVisitor(t = "popup", e, i) {  chrome.storage.local.get(["userId", "sessionId", "paidUsers"], function(o) {    o.sessionId || (o.sessionId = Math.random().toString(36).substr(2, 10), chrome.storage.local.set({      sessionId: o.sessionId    })), fetch(server + "/api/visitor/visitorRecord", {      method: "POST",      headers: {        "Content-Type": "application/json",        plugCode: plugCode      },      body: JSON.stringify({        userId: o.userId,        fromChannel: t,        sessionId: o.sessionId,        host: e,        url: i,        paidUsers: o.paidUsers      })    }).catch(o => console.log("Error:", o))  })}
What each visitorRecord POST body contains (sample values illustrative)
  • Visited host
    example.com

    The domain of the page you loaded.

  • Visited URL
    https://example.com/some/article?ref=123

    The full page address, including path and query string.

  • Session ID
    k3j9d81f2a

    A random ID generated once and reused for every page you visit.

  • User ID
    null

    Populated if a stored user ID exists; otherwise empty.

  • Report channel
    content

    Marks the record as coming from the page content script.

Where the browsing data goes
    • plug2025.bm-com.com

    Receives the visited host, full URL and session ID on each page load. Appears to be the extension vendor's own backend.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Read information about your displays

    system.display

  • Show you desktop notifications

    notifications

Where it sends data

Destinations our analysis observed 福橘-股票行情 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • plug2025.bm-com.com

    福橘-股票行情 sends data to plug2025.bm-com.com. 11 other extensions we have analysed send data here.

Updated 15 October 2026kncgndacgnbhpeneennchpemegepohcg