Is Price.com: Cash Back, Coupons & Price Comparison safe?

High risk

Price.com: Cash Back, Coupons & Price Comparison is high risk. Dynamic analysis captured the install event posting the active tab URL with a persistent device ID to us.i.posthog.com. Source analysis shows a daily heartbeat event takes the same path.…

Price.comv5.0.0Chrome Web Store
73Risk
Who publishes it

Price Technologies Inc - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Price.com
Declared legal entity
Price Technologies Inc
Registered address
10000 Santa Monica Boulevard, 2804, Los Angeles, CA 90067, US
Registered contact
PRICE
Website
help.price.com

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Price.com install analytics send the active tab URL and a device ID to PostHog

MediumunwantedCWE-359Dynamic sandbox

Dynamic analysis captured the install event posting the active tab URL with a persistent device ID to us.i.posthog.com.

What actually happens

You did this

You install the extension while a web page is open in your active tab.

No click or consent prompt was needed during the observed run.

The extension did this

The extension sends an install analytics event that includes the address of that open tab.

The request carries a persistent device ID and goes to us.i.posthog.com.

Captured request

POSThttps://us.i.posthog.com/capture/

HTTP 200, body {"status":"Ok"}. Sent from the extension service worker.

Headers
content-type
application/json
Body
{  "api_key": "<redacted>",  "event": "extension_installed",  "distinct_id": "08963a8d-9450-4155-b70d-135f9b29720b",  "properties": {    "reason": "install",    "url": "https://www.walmart.com/blocked?url=L3NlYXJjaD9xPXVzYitjYWJsZQ==&uuid=ca1cfd03-cea4-11f1-87e0-ddff56dba82d&vid=&g=b",    "user_id": null,    "manifest_version": "4.0.15"  }}

Fields in the captured install event

  • Page address
    https://www.walmart.com/blocked?url=L3NlYXJjaD9xPXVzYitjYWJsZQ==&uuid=ca1cfd03-cea4-11f1-87e0-ddff56dba82d&vid=&g=b

    The full URL of the tab you had open, including its query string.

  • Device ID
    08963a8d-9450-4155-b70d-135f9b29720b

    A persistent identifier that links events from this install over time.

  • Price.com user ID
    null

    Set from the Price.com cookie when present; null in the observed run.

  • Extension version
    4.0.15

    The installed build number.

Where the event is sent

    • us.i.posthog.com

    PostHog analytics ingestion endpoint (US region); received the event and returned HTTP 200.

What it can do

Permissions this extension asks for, as declared in version 4.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 5.0.0, which we have not unpacked yet.

  • Read and change your data on every site you visit

    <all_urls>

  • Schedule its own background tasks

    alarms

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Watch every request your browser makes

    webRequest

Updated 2 November 2026kmmpkhpajpecmpdmmbpjmkmcmfdahkcj