Is Simple Allow Copy 2 safe?
Simple Allow Copy 2 is medium risk. Every tab switch or page load sends the page's full URL, browser details, and a persistent device ID to apitwo.simpleallowcopytwo.com. The same ID appears every time, tying your browsing history to one profile.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Simple Allow Copy 2 tracks every site you visit with a persistent ID
Every tab switch or page load sends the page's full URL, browser details, and a persistent device ID to apitwo.simpleallowcopytwo.com.
The same ID appears every time, tying your browsing history to one profile.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You switch to a tab or a page finishes loading.
This fires on ordinary browsing, not on any extension feature you invoked.
The extension posts the active tab's URL and a persistent device ID to apitwo.simpleallowcopytwo.com.
The request repeats on every tab activation and page update while the extension is installed.
- Page URLhttps://www.example.com/checkout/cart?promo=SAVE10
The exact address of the page you're viewing, including path and query string.
- Device IDbee4cbc5-d119-4d7e-a8f7-d47f67623927
A UUID created once and stored locally; it stays the same on every request, linking all your visits together.
- Referring pagehttps://www.google.com/search?q=example
The page you navigated from, when the browser provides it.
- Site domainwww.example.com
The hostname of the page, sent separately from the full URL.
- Browser and OS detailsMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/128.0.0.0
Your browser's user agent string and operating system platform.
- Language settingen-US
Your browser's configured locale.
The minified telemetry handler in background/index.js
// Generate and persist a device ID the first time the extension runschrome.storage.local.get(['sacptwo'], (result) => { if (result.sacptwo === undefined) { const deviceId = self.crypto.randomUUID(); chrome.storage.local.set({ sacptwo: deviceId }); }});let lastTabId = 0;const lastUrlByTab = {};// Runs on every tab activation and every tab updatefunction reportActiveTab() { chrome.tabs.query({ active: true, currentWindow: true }, ([tab]) => { if (!tab || !tab.url) return; if (lastUrlByTab[tab.id] === tab.url && lastTabId === tab.id) return; // dedupe repeats lastTabId = tab.id; lastUrlByTab[tab.id] = tab.url; setTimeout(() => { const parsedUrl = new URL(tab.url); chrome.storage.local.get(['sacptwo'], (result) => { const deviceId = result.sacptwo; const payload = { timestamp: Date().toLocaleString(), uri: tab.url, user_agent: navigator.userAgent, domain: parsedUrl.hostname, locale: navigator.language, user_id: deviceId || '', platform: navigator.platform || '', referer: tab.initiator || '' }; fetch('https://apitwo.simpleallowcopytwo.com/skip', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }); }); }, 0); });}chrome.tabs.onActivated.addListener(reportActiveTab);chrome.tabs.onUpdated.addListener(reportActiveTab);JSON response controlling the toolbar icon state; observed during dynamic analysis alongside 44 other requests to the same endpoint with the same user_id across different active-tab URLs.
- Content-Type
- application/json
{ "timestamp": "Tue Sep 08 2026 14:32:07 GMT-0700", "uri": "https://www.amazon.com/gp/cart/view.html", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36", "domain": "www.amazon.com", "locale": "en-US", "user_id": "bee4cbc5-d119-4d7e-a8f7-d47f67623927", "platform": "Win32", "referer": ""}- apitwo.simpleallowcopytwo.com
Receives the active tab URL, referrer, browser/OS details, and the persistent device ID on every tab activation or update.
What it can do
Permissions this extension asks for, as declared in version 1.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Store data in your browser
storage
See the address and title of every tab you have open
tabs