Is 쿠팡 애드블록 — 쿠팡 광고상품 제거 safe?

Medium risk

The extension fetches encoded cookie values from a Firebase database and writes them into coupang.com product pages.

Alongside its ad-blocking function, the extension reads a remote Firestore document and decodes cookie names, values and a domain from it. When you open a coupang.com product page, it writes those cookies, plus a timestamp cookie, into the page. The cookie contents are controlled by the server and are not disclosed in the listing.

Super Extensionsv1.0.2Chrome Web Store
49Risk
Who publishes it

Super Extensions - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Super Extensions
Website
superextensions.channel.io/home

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ad blocker writes server-chosen cookies into coupang.com product pages

Code analysis shows the extension fetches obfuscated cookie names, values and a domain from a Firestore document, then sets them on coupang.com product pages.

Their purpose is not visible in the code.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You open a product page on www.coupang.com/vp/products/.

The extension did this

The extension sets cookies on coupang.com whose names, values and domain come from a remote Firestore document.

Cookie fields built by the service worker
  • Cookie names
    Decoded at runtime; not recoverable statically

    Taken from the keys of the Firestore tc map, decoded.

  • Cookie values
    Decoded at runtime; not recoverable statically

    Taken from the values of the tc map, decoded.

  • Timestamp cookie
    yyyyMMddHHmmss (e.g. 20260930142501)

    One extra cookie, named by decoded it_key, holds the current time.

  • Cookie domain
    Decoded at runtime; not recoverable statically

    Decoded do_key value, set with path / and 24 hour expiry.

The code that does this

Decoder and tab listener in the service worker

Readable version

Field decoder

background.bundle.js
// Each Firestore string is ROT13 -> reversed -> base64 -> UTF-8function decodeField(s) {  const rot13 = rotate13(s);  const reversed = Array.from(rot13).reverse().join("");  return new TextDecoder("utf-8").decode(Uint8Array.from(atob(reversed), c => c.charCodeAt(0)));}

Tab listener

background.bundle.js
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {  if (changeInfo.status === "complete" && tab.url && tab.url.startsWith("https://www.coupang.com/vp/products/")) {    if (!remoteConfig) return;    const cookies = {};    for (const [k, v] of Object.entries(remoteConfig.tc)) cookies[decodeField(k)] = decodeField(v);    cookies[decodeField(remoteConfig.it_key)] = yyyyMMddHHmmss(new Date());    const domain = decodeField(remoteConfig.do_key);    // each entry: {name, value, domain, path: "/", expires: now + 24h}    chrome.tabs.sendMessage(tabId, JSON.stringify({ action: "stc", cookies: [...] }));  }});
The code that does this

Content script writes the cookies

Readable version
content.bundle.js
if (action === "stc") {  for (const c of msg.cookies) {    if (c.name && c.value !== undefined && c.domain && c.path && c.expires)      document.cookie = `${c.name}=${encodeURIComponent(c.value)}; expires=${c.expires}; path=${c.path}; domain=${c.domain}; SameSite=`;  }}
Remote configuration source
    • firestore.googleapis.com

    Serves the document that supplies cookie names, values and domain.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed 쿠팡 애드블록 — 쿠팡 광고상품 제거 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • firestore.googleapis.com

    쿠팡 애드블록 — 쿠팡 광고상품 제거 sends data to firestore.googleapis.com. 22 other extensions we have analysed send data here.

Updated 15 October 2026laepnlnklkefaegbpkhdldipmdgkijfj