Is Revolut Shopper safe?

Medium risk

Revolut Shopper is medium risk. DA confirmed Revolut disables Chrome's built-in card autofill browser-wide, not just on Revolut's site. On load, the worker calls autofillCreditCardEnabled.set({value:false}). Undisclosed in listing/policy; manifest declares 'privacy'.

Revolut Ltdv3.9.3Chrome Web Store
45Risk
Who publishes it

Revolut Ltd - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Revolut Ltd
Declared legal entity
Revolut Ltd
Registered address
7 Westferry Circus, London E14 4HD, GB
Registered contact
Revolut Ltd
Website
www.revolut.com/contact-us

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

app.revolut.com
Also called by 3 other listings, including Vouch Verifier

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Revolut extension disables Chrome credit card autofill browser-wide

DA confirmed Revolut disables Chrome's built-in card autofill browser-wide, not just on Revolut's site.

On load, the worker calls autofillCreditCardEnabled.set({value:false}).

Undisclosed in listing/policy; manifest declares 'privacy'.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the Revolut extension.

No interaction beyond installation is required; the behavior fires on every service worker startup.

The extension did this

Chrome's built-in credit card autofill is turned off across your entire browser.

The extension calls chrome.privacy.services.autofillCreditCardEnabled.set({value: false}), a browser-wide setting that affects all websites, not just revolut.com.

When this fires

On every browser startup

The setting is re-applied each time the service worker initializes, on installation and on every subsequent browser startup, ensuring the autofill override persists across sessions.

The code that does this

Service worker startup, autofill disable call

Readable version
chrome && (  null == (Ec = chrome.privacy) ||  null == (Ac = Ec.services) ||  null == (wc = Ac.autofillCreditCardEnabled) ||  wc.get({}, (e => {    "controllable_by_this_extension" === e.levelOfControl &&      chrome.privacy.services.autofillCreditCardEnabled.set(        { value: false },        () => { chrome.runtime.lastError; }      );  })));setTimeout(mc);l().storage.local.remove("rewards-runner-state");
Dynamic analysis confirmation

During our test session, after installing the extension, we queried `chrome.privacy.services.autofillCreditCardEnabled.get({})` from the browser console and received: `{levelOfControl: 'controlled_by_this_extension', value: false}`. The `controlled_by_this_extension` status confirms the extension's `.set()` call had already executed. Uninstalling the extension restores the setting to its previous value.

What it can do

Permissions this extension asks for, as declared in version 3.9.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Change your browser's privacy and security settings

    privacy

Updated 30 September 2026hdlehfdjcalidklijenibmpcdgjfmafn