Is Simple Allow Copy 2 safe?

Medium risk

Simple Allow Copy 2 is medium risk. Every tab switch or page load sends the page's full URL, browser details, and a persistent device ID to apitwo.simpleallowcopytwo.com. The same ID appears every time, tying your browsing history to one profile.

48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Simple Allow Copy 2 tracks every site you visit with a persistent ID

Every tab switch or page load sends the page's full URL, browser details, and a persistent device ID to apitwo.simpleallowcopytwo.com.

The same ID appears every time, tying your browsing history to one profile.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You switch to a tab or a page finishes loading.

This fires on ordinary browsing, not on any extension feature you invoked.

The extension did this

The extension posts the active tab's URL and a persistent device ID to apitwo.simpleallowcopytwo.com.

The request repeats on every tab activation and page update while the extension is installed.

Fields sent in every telemetry request
  • Page URL
    https://www.example.com/checkout/cart?promo=SAVE10

    The exact address of the page you're viewing, including path and query string.

  • Device ID
    bee4cbc5-d119-4d7e-a8f7-d47f67623927

    A UUID created once and stored locally; it stays the same on every request, linking all your visits together.

  • Referring page
    https://www.google.com/search?q=example

    The page you navigated from, when the browser provides it.

  • Site domain
    www.example.com

    The hostname of the page, sent separately from the full URL.

  • Browser and OS details
    Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/128.0.0.0

    Your browser's user agent string and operating system platform.

  • Language setting
    en-US

    Your browser's configured locale.

The code that does this

The minified telemetry handler in background/index.js

Readable version
// Generate and persist a device ID the first time the extension runschrome.storage.local.get(['sacptwo'], (result) => {  if (result.sacptwo === undefined) {    const deviceId = self.crypto.randomUUID();    chrome.storage.local.set({ sacptwo: deviceId });  }});let lastTabId = 0;const lastUrlByTab = {};// Runs on every tab activation and every tab updatefunction reportActiveTab() {  chrome.tabs.query({ active: true, currentWindow: true }, ([tab]) => {    if (!tab || !tab.url) return;    if (lastUrlByTab[tab.id] === tab.url && lastTabId === tab.id) return; // dedupe repeats    lastTabId = tab.id;    lastUrlByTab[tab.id] = tab.url;    setTimeout(() => {      const parsedUrl = new URL(tab.url);      chrome.storage.local.get(['sacptwo'], (result) => {        const deviceId = result.sacptwo;        const payload = {          timestamp: Date().toLocaleString(),          uri: tab.url,          user_agent: navigator.userAgent,          domain: parsedUrl.hostname,          locale: navigator.language,          user_id: deviceId || '',          platform: navigator.platform || '',          referer: tab.initiator || ''        };        fetch('https://apitwo.simpleallowcopytwo.com/skip', {          method: 'POST',          headers: { 'Content-Type': 'application/json' },          body: JSON.stringify(payload)        });      });    }, 0);  });}chrome.tabs.onActivated.addListener(reportActiveTab);chrome.tabs.onUpdated.addListener(reportActiveTab);
Captured request
POSThttps://apitwo.simpleallowcopytwo.com/skip

JSON response controlling the toolbar icon state; observed during dynamic analysis alongside 44 other requests to the same endpoint with the same user_id across different active-tab URLs.

Headers
Content-Type
application/json
Body
{  "timestamp": "Tue Sep 08 2026 14:32:07 GMT-0700",  "uri": "https://www.amazon.com/gp/cart/view.html",  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36",  "domain": "www.amazon.com",  "locale": "en-US",  "user_id": "bee4cbc5-d119-4d7e-a8f7-d47f67623927",  "platform": "Win32",  "referer": ""}
Where the browsing data goes
    • apitwo.simpleallowcopytwo.com

    Receives the active tab URL, referrer, browser/OS details, and the persistent device ID on every tab activation or update.

What it can do

Permissions this extension asks for, as declared in version 1.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026amnlhffheggkehikhanljohklfjiailo