Is Progressive Shopper safe?
Progressive Shopper sends each HTTPS page's hostname to progressiveshopperapi.com when pages load.
The content script runs on every HTTPS page and triggers as soon as the page loads. It passes the current page URL and hostname to the background script, which requests Progressive Shopper's API using the visited hostname.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Progressive Shopper reports every HTTPS site you visit to its own API
Every time you load an HTTPS page, the extension sends that page's hostname to progressiveshopperapi.com.
We observed this fire on live navigations to amazon.com, ebay.com, and walmart.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any HTTPS page, such as an online store.
The extension's background worker requests progressiveshopperapi.com with that page's hostname in the URL.
This happens on every HTTPS navigation, not just on stores the extension has data about.
- Site you visitedwww.amazon.com
The hostname of the page you just loaded, sent in the request path on every navigation.
200 OK, observed on live navigations to amazon.com, ebay.com, and walmart.com during dynamic analysis; a fourth request to a non-existent example.com host returned 400.
Content script reports the page, background worker forwards the hostname
Content script, on every page
function onPageLoad() { chrome.runtime.sendMessage({ command: "LOAD_POLITICAL_DATA", url: window.location.href, // built but never sent (see below) host: window.location.host, // this is the field that actually travels autoLoad: true, forceLoad: false });}onPageLoad(); // runs immediately on every https://*/* pageBackground worker, on receiving the message
async function loadPoliticalData(request) { // postData.url is assembled here but is not attached to the fetch below const unusedPostData = { url: encodeURIComponent(request.url) }; const endpoint = "https://www.progressiveshopperapi.com/allInfo/getOneCompany/" + request.host; const response = await fetch(endpoint, { method: "GET" }); // GET, no body return response.json();}- progressiveshopperapi.com
The extension's own backend. Receives the hostname of every HTTPS page you visit, used to classify the site before showing a shopping-guidance icon.
Where it sends data
Destinations our analysis observed Progressive Shopper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.progressiveshopperapi.com
Progressive Shopper sends data to www.progressiveshopperapi.com. No other extension we have analysed sends data here.