Is Pop2Watch safe?
This extension helps you keep track of upcoming TV shows and movies.
It provides a way to follow upcoming TV shows and movies. The store description says it may collect anonymous technical data to function properly.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote-config ad injection on API-defined pages
Pop2Watch contacts api.pop2watch.com/decoration_sets on start, getting an ad-site config.
Matches get banners, iframes, or overlays from advertiser URLs incl. metaffiliation.com.
Targets are server-controlled; listed only as a TV tracker.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You load any web page that matches a URL pattern set by Pop2Watch's ad server.
Pop2Watch injects its ad script into the page and renders banner images, iframes, or overlay ads linked to advertisers including metaffiliation.com.
The list of target sites is downloaded from api.pop2watch.com and cached locally. It can be updated by the server at any time without a new extension version.
HTTP 200. Response body cached in chrome.storage.local keys 'campaigns' (9230+ chars) and 'decorations' (15026+ chars). Decorations contain campaignId-keyed entries with DOM selectors, injection positions, banner types, and advertiser URLs including metaffiliation.com tracking links.
- Accept
- application/json
- Content-Type
- application/json
- X-APP-VERSION
- 1.4.4
Sets which sites get ads, where on the page (CSS selector, position), and which advertiser URL is linked. A 15KB+ config was observed.
- Location
- chrome.storage.local keys 'decorations' and 'campaigns'
{ "campaigns": "[{\"_id\":\"camp-42\",\"url\":\"https://www.metaffiliation.com/trk?mclic=AFF123&cpnid=7892\",\"banners\":[{\"type\":\"background_left\",\"url\":\"https://cdn.pop2watch.com/banners/left_300x600.jpg\"},{\"type\":\"background_right\",\"url\":\"https://cdn.pop2watch.com/banners/right_300x600.jpg\"}]}]", "decorations": "[{\"_id\":\"campaign-1\",\"patterns\":[\"www.voirfilms.al\",\"*.streaming-partner.com\"],\"css\":[],\"position\":\"after\",\"type\":\"bn_image\",\"campaignId\":\"camp-42\",\"selector\":\"div.container div.row:nth-of-type(1)\"}]"}The ad injection pipeline, fetch config, then inject on matching pages
Decoration config fetch
// background.js:11088 — fetches the ad targeting config from the serverasync fetchDecorationKit() { const url = this.url + '/decoration_sets'; // 'https://api.pop2watch.com/decoration_sets' return await fetch(url, this.api_options) // api_options includes X-APP-VERSION header .then(response => { if (response.ok) return response.json(); throw new Error('Status code error : ' + response.status); });}Matching + injection listener
// background.js:11318 — runs on every page load; injects ads on matching sitesbrowser.tabs.onUpdated.addListener((tabId, changeInfo, tab) => { if ((tab.url.startsWith('http://') || tab.url.startsWith('https://')) && changeInfo.status === 'complete') { const currentUrl = tab.url; In.getDecorablePagesFilters().then(patterns => { // patterns comes from chrome.storage.local['decorations'][*].patterns if (patterns.some(pattern => currentUrl.match(pattern))) { browser.scripting.executeScript({ target: { tabId: tabId, allFrames: false }, files: ['decorate.js'] // renders iframe/image/overlay banners }).catch(err => En.handleTabAccessError(err, 'Decorator')); } }); }});- api.pop2watch.com
Pop2Watch's ad config server. Delivers the list of target sites, ad formats, and campaign definitions to the extension on browser start.
- metaffiliation.com
Affiliate tracking network whose URLs appear in campaign 'url' fields. Clicking injected ads redirects through metaffiliation.com tracking links.
- www.voirfilms.al
French streaming site observed as an ad target pattern in the DA-captured decoration config. Listed as referer in campaign definitions.