Is SaaS Security Scanner safe?

Medium risk

SaaS Security Scanner sends the URL, title and referrer of every page you visit to fulhar.com, on by default.

A content script runs on all http and https pages and reports each page's full URL, title, referrer, time spent, timezone and language, plus a persistent visitor ID, to fulhar.com through the background worker. Tracking is enabled by default with no opt-in. The extension also rewrites AliExpress links on any website to its own affiliate link and re-applies the rewrite if another script changes it.

readyandmakesv3.0.0Chrome Web Store
49Risk
Who publishes it

readyandmakes - 6 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
readyandmakes

Same store account

6 other listings published from this account, 382 users between them. 1 of them carries a finding.

Free YouTube SEO & Tag and Video Analyzer: Get More Subscribers tools330CleanSearch Ali Price By Image23MediumAli Lens with Product Search By Image13MediumAli Agent: AliExpress Image Search & Tools8LowAli Seller Toolkit6LowUniversal Form Autofill With Job Search2Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Page-view tracker reports every page URL and title to fulhar.com, on by default

Code analysis shows a content script on every http(s) page sends the page URL, title and visit time to fulhar.com through the service worker.

It is on unless apTrackingEnabled is false.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open or navigate to any web page in the top frame.

The extension did this

The page URL and title are queued and posted to fulhar.com.

Reports repeat every 15 seconds while the page is open.

Fields in each reported page event
  • Page address
    https://example.com/account/orders?id=4821

    The full address of the page you are viewing, including its path and query.

  • Page title
    Your orders - Example Store

    The title of the page, up to 512 characters.

  • Referrer
    https://www.google.com/

    The page you came from.

  • Visible time
    42310

    How long the page was visible in the tab, in milliseconds.

  • Timezone and language
    Europe/London, en-GB

    Your timezone and browser language.

  • Visitor ID
    7b0e3c1a-52d4-4f0e-9a6b-1c8d2e4f5a60 (illustrative)

    A persistent random ID stored in the extension, linking all reports from this browser.

The code that does this

Tracking is on by default and posts to fulhar.com

Readable version

Event sent from the page

tracker.js
var event = {      event_id: view.id,      url: view.url,      title: (document.title || '').slice(0, 512),      referrer: view.referrer,      session_id: view.session,      started_at: new Date(view.startedAt).toISOString(),      duration_ms: Math.round(visible),      timezone: timezone(),      language: (navigator.language || '').slice(0, 32),    };
When this fires

Every 15 seconds

While a page is open, tracker.js sends an update every 15 seconds, plus on visibility change, page hide and in-page URL change.

Where page events are sent
    • fulhar.com

    Receives batched page URL, title, referrer, timing and visitor ID events at /api/v1/user-tracker/track/batch/.

Check if you're affected

Checks an unpacked copy of the extension for the all-URLs tracker content script and the fulhar.com endpoint.

find_tracker_endpoint.sh · sh
#!/bin/sh# Run inside the unpacked extension foldergrep -n '"<all_urls>"' manifest.jsongrep -n 'tracker.js' manifest.jsongrep -n 'fulhar.com/api/v1/user-tracker' tracker-bg.jsgrep -n 'apTrackingEnabled !== false' tracker-bg.jsgrep -n 'url: view.url' tracker.js
How to run it
  1. 1Unpack the CRX.
  2. 2cd into the folder.
  3. 3Run the script.
  4. 4Each grep should print a matching line.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed SaaS Security Scanner contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.comwidely used

    SaaS Security Scanner sends data to s.click.aliexpress.com. A widely used service: 36 other extensions we have analysed send data here.

  • fulhar.com

    SaaS Security Scanner sends data to fulhar.com. One other extension we have analysed sends data here.

Updated 15 October 2026igpppinobicablpegenmfdlmjnhgadaj