Is Les bons Plans remises & Cashback FLOA safe?

Medium risk

Les bons Plans remises & Cashback FLOA sends recognized merchant visits to Google Analytics with a persistent extension client ID.

When a supported merchant page shows the FLOA cashback banner, the extension posts a Google Analytics event containing a persistent extension client ID and the matched merchant name. The claim notes this can happen after navigation when notification display is enabled or accepted, and does not show the full page URL being sent in that event.

Plebicomv1.0.13Chrome Web Store
50Risk
Who publishes it

PLEBICOM - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Plebicom
Declared legal entity
PLEBICOM
Registered address
131 Bd de Sébastopol, Paris 75002, FR
Registered contact
PLEBICOM

Same store account

2 other listings published from this account, 88k+ users between them, none of them carrying a finding.

eBuyClub80k+CleanAlerte Bons Plans Emrys la carte8k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Merchant page visits sent to Google Analytics with a persistent client ID

Visiting a page for a recognized merchant, e.g.

Etsy, Intersport, or LG.com, makes the extension send an event to Google Analytics with the merchant name and a persistent browser ID.

This fires automatically the first time the banner shows.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit a page for a merchant the extension recognizes, such as etsy.com.

The cashback banner appears because the page matches an entry in the extension's remote merchant list.

The extension did this

The extension sends a Google Analytics event naming the merchant and carrying a persistent ID tied to your browser.

On Chrome this happens automatically the first time the banner is shown, without a separate consent prompt.

Fields included in the Google Analytics event
  • A persistent ID for your browser
    42f50f8d-0539-4c2e-8635-367dd8865eb6

    This ID stays the same across every merchant page you visit, so Google Analytics can link them all to one browser.

  • The merchant you're viewing
    Etsy

    The name of the recognized merchant on the page you're currently on.

  • Event type
    cta_alerting

    Whether the cashback offer is already active for you or is just being suggested.

The code that does this

The banner-display trigger and the background dispatch to Google Analytics

Readable version

Renamed: banner visibility trigger

isShowNotification: function () {  if (!this.acceptPolitics) return false;  if (!this.merchant) return false;  if (this.hideTab) return false;  if (this.merchant.hideAlerting !== 0) return false;  if (!this.showNotification) return false;  if (!this.merchant.showNotification) return false;  var eventName = this.merchant.activated ? "cta_activated" : "cta_alerting";  this.sendEvent({ category: "CTA", name: eventName, label: this.merchant.name });  return true;}

Renamed: background dispatch

sendAnalytics: function (message) {  var payload = message.data;  var force = payload && payload.force;  // acceptPolitics defaults to true on Chrome (see cause_effect above),  // so this gate rarely blocks the call in practice.  if (!(this.acceptPolitics || force)) return;  var label = payload.label ? "*" + payload.label : "";  var event = {    clientId: this.settings.data.analyticsClientId,  // persistent UUID stored on-device    name: payload.name,        // e.g. "cta_alerting"    category: payload.category,    label: label,               // e.g. "*Etsy"    event: "5(" + payload.category + "*" + payload.name + label + "*" + getBrowserName() + ")",    gaid: GA_MEASUREMENT_ID,    utmcc: "__utma=" + randomA + "." + randomB + "." + nowMs + "." + nowMs + ".1"  };  this.analytics && this.analytics.send(event);}

Renamed: Measurement Protocol POST

send: function ({ name, clientId, ...params }) {  var url =    "https://www.google-analytics.com/mp/collect" +    "?measurement_id=" + GA_MEASUREMENT_ID +    "&api_secret=<redacted>";  return fetch(url, {    method: "POST",    body: JSON.stringify({      client_id: clientId,      events: [{ name, params }]    })  });}
Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-714WLMNW9D&api_secret=<redacted>
Body
{  "client_id": "42f50f8d-0539-4c2e-8635-367dd8865eb6",  "events": [    {      "name": "cta_alerting",      "params": {        "category": "CTA",        "label": "*Etsy"      }    }  ]}
Where the merchant-visit event goes
    • www.google-analytics.com

    Google's Measurement Protocol endpoint (Google LLC). Receives the persistent client ID and matched merchant name for each recognized merchant page visited with the banner enabled.

What it can do

Permissions this extension asks for, as declared in version 1.0.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • See the address and title of every tab you have open

    tabs

  • Watch every request your browser makes

    webRequest

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed Les bons Plans remises & Cashback FLOA contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Les bons Plans remises & Cashback FLOA sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026kmfgpbjcaigfilcmdlndbcjadobcfebd