Is Overprice: Amazon Price, Fakespot, Review VOC analysis (former Leapca) safe?

Medium risk

Overprice sends page URLs to overprice.app and can return server-directed page content extractions.

On navigation, Overprice sends the current page URL with a stable FingerprintJS visitor ID to overprice.app. Its server can respond with URLs and parsing rules, after which the extension fetches permitted ecommerce or social pages, extracts text, HTML, or attribute values, and sends the parsed results back to overprice.app.

bob0103779v2.1.1Chrome Web Store
45Risk
Who publishes it

Keble - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
bob0103779
Declared legal entity
Keble
Registered address
Shenzhen, Shenzhen Shi, Guangdong Sheng 510000, CN
Registered contact
Zma
Website
overprice.app/privacy-policy

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Overprice sends the page you're on plus a device fingerprint on every visit

On every website you open, Overprice computes a stable FingerprintJS device ID and sends it with the full page URL to its own backend, overprice.app.

We observed this fire on ordinary navigation, unrelated to any price check.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any webpage in a tab.

The destination doesn't have to be Amazon, Aliexpress, or another site Overprice is built to help with.

The extension did this

Overprice computes a device fingerprint and sends it with the page's URL to its own server.

This happens on the very first navigation after install and repeats on every page load after.

Captured request
GEThttps://overprice.app/api/v0/pag/ping?f=0

Confirmed during dynamic analysis: navigating to a test page was immediately followed by this request, and the X-Token decoded to the exact URL just visited plus a FingerprintJS-shaped visitor ID.

Headers
X-Token
ZXlKMWNtd2lPaUpvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsTG1OdmJTOGlMQ0ptYVc1blpYSndjbWx1ZENJNklqYzBaREUyTVdJNU5HUTBOamc1TjJObU56RTRNekExTkRVd09EVTVNRFJtSW4wMQ2
Why you can't catch this in DevTools

The X-Token header looks like an opaque credential but it is not encrypted. It is the request's own JSON body, base64-encoded twice with a digit appended noting how much padding was stripped.

Decoded value
{  "url": "https://www.example.com/",  "fingerprint": "74d161b94d46897cf71830545085904f"}
The code that does this

Reading the page URL and device fingerprint, then messaging the background worker

Readable version

Beautified: reads the URL, fetches a FingerprintJS visitor ID, hands both to the caller

content-scripts/any.js:12382
function P6(u) {  return Ny(this, void 0, void 0, function() {    var t, r, l, c, f, d, m;    return wy(this, function(g) {      switch (g.label) {        case 0:          g.trys.push([0, 9, , 10]), t = window.location.href, r = void 0, g.label = 1;        case 1:          return g.trys.push([1, 4, , 5]), [4, z6.load()];        case 2:          return (l = g.sent()) ? [4, l.get()] : [2];        case 3:          return c = g.sent(), r = c == null ? void 0 : c.visitorId, [3, 5];        case 4:          return f = g.sent(), [2];        case 5:          return g.trys.push([5, 7, , 8]), [4, u({            fingerprint: r,            currentUrl: t          })];        case 6:          return g.sent(), [3, 8];        case 7:          return d = g.sent(), [3, 8];        case 8:          return [3, 10];        case 9:          return m = g.sent(), [3, 10];        case 10:          return [2]      }    })  })}

Beautified: forwards {fingerprint, currentUrl} to the background service worker as a 'ping' message

content-scripts/any.js:13791
async function S4(u) {  try {    await u1("ping", u, "background")  } catch {}}
What the ping to overprice.app carries
  • Device fingerprint
    74d161b94d46897cf71830545085904f

    A FingerprintJS ID that stays the same across sites and sessions, letting Overprice link separate visits back to the same device.

  • Current page URL
    https://www.example.com/

    The full address of whatever page you were on when the ping fired, including pages that have nothing to do with shopping.

Where this goes
    • overprice.app

    Overprice's own backend, declared in the extension's host_permissions. Receives the fingerprint/URL ping described above on every navigation.

Where it sends data

Destinations our analysis observed Overprice: Amazon Price, Fakespot, Review VOC analysis (former Leapca) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • overprice.app

    Overprice: Amazon Price, Fakespot, Review VOC analysis (former Leapca) sends data to overprice.app. No other extension we have analysed sends data here.

Updated 30 September 2026oobnhmioebnddcabnngemmjjdffhiphf