Is SavvyConnect By SavvyShares safe?
SavvyConnect streams every page you visit, plus raw request/response headers including cookies, to Luth Research.
As a market-research panel extension, SavvyConnect tracks the URL, page title, and referrer of every http/https page you visit along with tab activity, and streams this continuously to Luth Research's servers tagged with your panelist ID. It also copies every outgoing and incoming HTTP header on every site you browse, including Cookie and Authorization values, into the same data stream. On Google, Bing, and Yahoo search results pages it additionally captures and sends the full rendered page HTML.
Who publishes itLuth Research - no other listings under this identity, 10 shared hostnames
Luth Research - no other listings under this identity, 10 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 10 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
SavvyConnect copies your Cookie and Authorization headers site-wide
SavvyConnect background listeners copy every request and response header value, including Cookie and Authorization, from all HTTP(S) traffic and queue it for Luth Research servers.
No header allowlist limits what gets copied.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You load a page on any HTTP or HTTPS site while signed into an account that sets a session cookie or sends an Authorization header.
SavvyConnect's background listeners copy every request and response header value, Cookie and Authorization included, into an event queued for Luth Research's servers.
- Session cookiesessionid=8f2a1c9e77b04d6f9b0e1d55e2fca3a1
Whatever cookie value your browser sends for the site, including a login session ID, is copied verbatim into the queued event.
- Authorization headerBearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example
A bearer token or API key a site sends is copied verbatim, letting the captured event replay your authenticated request.
- Requested URLhttps://mail.example.com/inbox?view=unread
The exact page and query string you loaded, on any site, not just panel-related traffic.
- Set-Cookie response headersessionid=8f2a1c9e77b04d6f9b0e1d55e2fca3a1; Path=/; HttpOnly
A new or refreshed cookie value a site issues back to your browser is captured too.
Header copy loop in common/EventHandler.js, no allowlist or denylist
Annotated: every header name/value is copied, Cookie and Authorization included
common/EventHandler.jsfor (let ind in details.requestHeaders) { // details.requestHeaders is the full list of headers Chrome/Firefox sent // on the wire for this request, Cookie and Authorization included. var aHeader = details.requestHeaders[ind]; if (aHeader.value) { // No name check here: every header name/value pair is copied, // including Cookie, Authorization, and any other credential header. myHttpReq.headers[aHeader.name] = aHeader.value; } else if (aHeader.binaryValue) { myHttpReq.headers[aHeader.name] = encodeURI(aHeader.binaryValue); }}- api04.luthresearch.com
Receives batched, LZW-compressed HttpRequestEvent/HttpResponseEvent objects, including raw Cookie and Authorization header values, over a persistent WebSocket.
- surveysavvy.com
Panel-operator brand under which SavvyConnect is distributed; listed as the extension homepage and author Luth Research.
Replays the exact header-copy loop from EventHandler.js against a sample requestHeaders array containing a Cookie and an Authorization header to show neither is filtered out.
- Node.js 18+
// Reproduces the header-copy loop from SavvyConnect's common/EventHandler.js// (onWebRequest / onWebRequestComplete) against a sample requestHeaders array// to show it copies every header name/value pair verbatim, with no// allowlist or denylist for Cookie / Authorization / Set-Cookie.function copyHeaders(details) { const out = {}; for (const ind in details.requestHeaders) { const aHeader = details.requestHeaders[ind]; if (aHeader.value) { out[aHeader.name] = aHeader.value; } else if (aHeader.binaryValue) { out[aHeader.name] = encodeURI(aHeader.binaryValue); } } return out;}// Sample chrome.webRequest.onSendHeaders "details.requestHeaders" shape,// as Chrome/Firefox would deliver it for an authenticated request.const sampleDetails = { requestHeaders: [ { name: "Host", value: "mail.example.com" }, { name: "Cookie", value: "sessionid=8f2a1c9e77b04d6f9b0e1d55e2fca3a1" }, { name: "Authorization", value: "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example" }, { name: "User-Agent", value: "Mozilla/5.0" }, ],};const copied = copyHeaders(sampleDetails);console.log(JSON.stringify(copied, null, 2));console.log( "Cookie present:", "Cookie" in copied, "| Authorization present:", "Authorization" in copied,);- 1Save as reproduce-header-copy.js.
- 2Run node reproduce-header-copy.js.
- 3Inspect the printed headers object; Cookie and Authorization are present unmodified.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 5.0.1891. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
See the address and title of every tab you have open
tabs
Watch every request your browser makes
webRequest
Store data in your browser
storage
Schedule its own background tasks
alarms
Act on the current tab, but only after you click the extension
activeTab
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Where it sends data
Destinations our analysis observed SavvyConnect By SavvyShares contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api04.luthresearch.com
SavvyConnect By SavvyShares sends data to api04.luthresearch.com. One other extension we have analyzed sends data here.
- Luth Research
SavvyConnect By SavvyShares sends data to Luth Research. Named as a recipient in this extension's own analysis.