Is Shopee Save safe?

Question

Accepted Answer

Shopee Save is medium risk. The extension encrypts its configuration with AES-256-CBC and stores it in your browser's local storage under the keys __AG_ and __AG_HEHE. The decryption passphrase — used with PBKDF2-SHA512 to derive the AES key — is publicly recoverable: it is embedded verbatim in the extension's background script as an array of ASCII character codes that resolves to the string dj(Nrr)a,yc%)h*K#Vv!.DK@gjBBZs)dfzg(YUSjb). Anyone who downloads the extension from the Chrome Web Store can recover this passphrase and decrypt the stored configuration. Our dynamic analysis confirmed live storage keys __AG_ and __AG_HEHE are present after a Shopee navigation, and a proof-of-concept script successfully derived the AES key using PBKDF2-SHA512 with 999 iterations. The extension's stated purpose is downloading images and videos from Shopee product pages. However, its manifest.json configures content scripts to run on every website you visit — not just Shopee. The vendors.js (React framework, ~20 KB) and content_scripts.js files are injected at document_end on all URLs, giving the extension read and write access to the page DOM, form fields, and page content on banking sites, email providers, social media, and any other site you visit. Our dynamic analysis observed content script resources loading on non-Shopee origins.

Is Shopee Save - Download Product Images & Video safe?

Findings