Is Shopee Save safe?

Question

Accepted Answer

Shopee Save is medium risk. Every time you open a Shopee product page, the extension intercepts the navigation before the page loads and makes a POST request to imgvidcfig.com/api/shopy. That external server receives your Shopee origin and the product URL path, then returns a redirect URL. Your browser tab is briefly sent to imgvidcfig.com with the original Shopee URL encoded in the URL's query parameter, before being redirected back to Shopee. Our dynamic analysis captured this round-trip in two independent sessions, with the product path appearing verbatim in the uuid request header sent to imgvidcfig.com. The extension encrypts its configuration with AES-256-CBC and stores it in your browser's local storage under the keys __AG_ and __AG_HEHE. The decryption passphrase — used with PBKDF2-SHA512 to derive the AES key — is publicly recoverable: it is embedded verbatim in the extension's background script as an array of ASCII character codes that resolves to the string dj(Nrr)a,yc%)h*K#Vv!.DK@gjBBZs)dfzg(YUSjb). Anyone who downloads the extension from the Chrome Web Store can recover this passphrase and decrypt the stored configuration. Our dynamic analysis confirmed live storage keys __AG_ and __AG_HEHE are present after a Shopee navigation, and a proof-of-concept script successfully derived the AES key using PBKDF2-SHA512 with 999 iterations.

Is Shopee Save - Download Product Images & Video safe?

Findings