Is Real-Time Crypto Price Alert Tracker safe?

Medium risk

Real-Time Crypto Price Alert Tracker bundles the Mellowtel SDK, which can load server-chosen pages in hidden frames after opt-in.

The extension includes the Mellowtel SDK in a content script on all sites and in its background worker. Only after the user opts in on mellow.tel, it opens a websocket to ws.mellow.tel and loads URLs chosen by that server in hidden iframes using the user's IP address and browser. The SDK also installs rules that remove frame-blocking and CORS-related headers on sub-frame and XHR responses.

v1.3.8Chrome Web Store
49Risk
Who publishes it

11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumVideo Speed Controller - Universal Video Playback Speed59Medium5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mellowtel SDK lets a remote server load pages in off-screen frames after opt-in

Code analysis shows the extension embeds the Mellowtel SDK.

After opt-in it connects to ws.mellow.tel and loads server-chosen URLs in off-screen frames using your IP address and browser.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You complete the opt-in at mellow.tel, reached from the extension's Mellowtel Settings button.

No automatic opt-in was found at install.

The extension did this

The extension opens a websocket to ws.mellow.tel and loads URLs chosen by that server in off-screen frames.

The code that does this

SDK initialisation in both execution contexts

Readable version

Content script entry

const sdk = new Mellowtel('1448c4f8');await sdk.initContentScript('pascoli.html');

Service worker entry

const sdk = new Mellowtel('1448c4f8');await sdk.initBackground();
The code that does this

Kill-switch fetch that precedes the crawler

Readable version
// t = this extension's id, n = timestamp cache-busterconst res = await fetch(`https://mellowtel-bucket.s3.us-east-1.amazonaws.com/switch/${extId}.txt?${now}`);// 403 (no file) => treated as enabled; body '0' => disabled, anything else => enabled
Hosts the SDK contacts
    • ws.mellow.tel

    Websocket that delivers server-chosen URLs to load (Mellowtel crawler service).

    • api.mellow.tel

    Approval endpoint checked before the crawler connects.

    • mellowtel-bucket.s3.us-east-1.amazonaws.com

    Per-extension on/off switch file read at startup.

What the frames expose
  • Your IP address
    203.0.113.24 (illustrative)

    Server-chosen pages are requested from your connection, not the vendor's.

  • Pages loaded
    https://example.com/listing/1042 (illustrative)

    The remote server decides which sites your browser visits in off-screen frames.

  • Browser headers
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) Chrome/130 (illustrative)

    Requests carry your browser's request headers.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Real-Time Crypto Price Alert Tracker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Real-Time Crypto Price Alert Tracker sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Real-Time Crypto Price Alert Tracker sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

Updated 15 October 2026fiebjoapbhobkgnfkeefpjfembalkngj