Is Made-in-China search by image safe?
Search by image for China import is high risk. Code analysis shows the content script fires a page_view on every http/https page you load, not just shopping sites. It reaches Google Analytics with the page URL, title, referrer, and a client ID reused across every site.…
Who publishes italiprice3 - 18 other listings from the same operator, none carrying a finding
aliprice3 - 18 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 176k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every page you visit is reported to Google Analytics, not just shopping sites
Code analysis shows the content script fires a page_view on every http/https page you load, not just shopping sites.
It reaches Google Analytics with the page URL, title, referrer, and a client ID reused across every site.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You load any ordinary website, one that has nothing to do with shopping or price comparison.
The content script runs on every http and https page because it is not scoped to the extension's supported shopping platforms.
The extension sends that page's URL, title, and referrer to Google Analytics under a persistent per-install ID.
The same client ID is reused on every site, so Google Analytics can link your visits across unrelated pages into one profile.
The page_view queue fires on every page load, sent with a persistent client ID
The page-load queue, renamed
assets/js/chunk-common.jsfunction initPageViewQueue() { if (!window.__gaQueue) { window.__gaQueue = []; if (navigator.sendBeacon) { window.__gaQueue.push(["page_view", "page_view", { page_title: document.title, page_location: document.location.href, page_referrer: document.referrer }]); setInterval(() => { flushQueue([...window.__gaQueue]); window.__gaQueue = []; }, 3000); window.addEventListener("beforeunload", () => { flushQueue([...window.__gaQueue]); window.__gaQueue = []; }); } }}The beacon send, renamed. tid is the extension's fixed GA4 property ID
assets/js/background.jsasync function getClientId() { const installed = (await storage.get("installed"))?.data || {}; return installed.userId || `N${randomId()}`; // generated once, reused forever}// ... later, per event:navigator.sendBeacon(buildUrl("https://www.google-analytics.com/g/collect", { v: "2", tid: "G-R4HYCBPMX7", cid: clientId, sid: sessionId, sr: `${screen.width}x${screen.height}`, dl: document.location.href, dr: document.referrer, dt: document.title}), body);- Page URLdl=https://mail.example.com/inbox?tab=work
The full address of the page you're on, including path and query string, on any site, not just shopping sites.
- Client IDcid=N4f8a2c19d0
A per-install ID generated once and reused on every event, letting all your visits be tied to one profile.
- Referrerdr=https://www.google.com/search?q=example
The page you came from before this one, which can reveal search terms or the site you were previously browsing.
- Page titledt=Account Settings - Example Bank
The browser tab title, which often summarizes what the page is about.
- www.google-analytics.com
Receives the page_view beacon (GA4 Measurement Protocol) for every http/https page you load with a fixed property ID and your persistent client ID.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.