Is Slice - You browse. We pay. safe?
Slice is high risk. On every page visited, Slice sends the full URL to pal.sli.ce.it/fetch_slice.php, a VAST ad server, with a persistent per-install ID (appUuid) enabling cross-session tracking. 23 POSTs seen in one session, plus a marker confirming URL sent.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page URLs Forwarded to VAST Ad Server on Every Visit
On every page visited, Slice sends the full URL to pal.sli.ce.it/fetch_slice.php, a VAST ad server, with a persistent per-install ID (appUuid) enabling cross-session tracking. 23 POSTs seen in one session, plus a marker confirming URL sent.
You navigate to any HTTPS page while Slice is installed and active.
Slice POSTs your full page URL and a persistent per-install UUID to pal.sli.ce.it/fetch_slice.php to retrieve a VAST video ad.
The UUID (appUuid) ties this request to your specific installation across all pages and sessions, allowing the VAST server to build a cross-site browsing profile.
{
"url": "https://en.wikipedia.org/wiki/<page>",
"appUuid": "807601247301573382",
"version": "1.4.4"
}| Field | Value | Why it matters | |
|---|---|---|---|
Page URL | https://en.wikipedia.org/wiki/Privacy_laws | The full address of the current page, including path and query parameters. | |
App UUID | 807601247301573382 | A persistent numeric ID unique to your Slice install. Sent with every request, letting the server track pages across sessions. | |
Extension version | 1.4.4 | Which version of Slice is installed. |
nn(), URL + UUID transmission to VAST server (background.js)
const nn = async function(pageUrl) {
const appUuid = await ur(); // persistent per-install identifier
const version = k(); // extension version
let adData = { title: '', description: '', url: '', events: [], media: { url: '' } };
const response = await tn('https://pal.sli.ce.it/fetch_slice.php', {
method: 'POST',
body: JSON.stringify({
url: pageUrl, // full page URL from content script
appUuid, // persistent install UUID
version // extension version
})
});
// ... parse VAST XML response ...
};- pal.sli.ce.it
Slice VAST video ad server. Receives the full URL of every page visited alongside a persistent per-install UUID. Operated by AddSlice.
Browsed URLs Sent to Ad Server on Every Page Visit
Every page you navigate to has its full URL, path and query string included, sent to api.sli.ce.it/v1/ads/native for targeted ads.
Every HTTPS page, plus your app version, reaches Slice's ad infrastructure. 23 POSTs seen in one session.
You navigate to any HTTPS page while Slice is installed and active.
Slice transmits the full URL of that page to api.sli.ce.it/v1/ads/native to fetch a targeted ad.
This occurs automatically on every page load and SPA navigation, with no user interaction required beyond having the extension installed.
| Content-Type | application/json |
{
"appTaxonomies": {},
"version": "1.4.4",
"url": "https://en.wikipedia.org/wiki/<page>",
"isOverlay": true,
"returnImageAsURL": true
}| Field | Value | Why it matters | |
|---|---|---|---|
Page URL | https://en.wikipedia.org/wiki/Privacy_laws | The full address of the page you are viewing, including the path and any search parameters. | |
Extension version | 1.4.4 | Which version of Slice you have installed. | |
Ad taxonomy context | {} | A structured object (appTaxonomies) sent alongside the URL for ad targeting classification. |
URL capture and transmission in content.js and background.js
r = new URL(window.location.href);
n = "".concat(r.origin).concat(r.pathname).concat(r.search);
// ... then:
chrome.runtime.sendMessage({ type: "getNative", url: n, isOverlay: true });Sr = async function(t, r) {
await Tr("https://api.sli.ce.it/v1/ads/native", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
appTaxonomies: {},
version: k(),
url: t, // full page URL from content script
isOverlay: r,
returnImageAsURL: true
})
});
};- api.sli.ce.it
Slice ad server. Receives full page URL on every navigation to serve targeted ads. Operated by AddSlice.
Remote Config Controls Ad Injection Rates for All Users
Slice polls api.addslice.com/v1/apps/me/config every 10 min for ad limits governing daily banner, native, push, click, and affiliate ad volume.
The server can change this for all users with no update or notice.
Three GETs in 726 seconds.
Every 10 minutes, a Chrome alarm named 'fetchAppConfig' fires in the background service worker.
The operator's server at api.addslice.com returns an adLimits object that overwrites the extension's hardcoded ad-injection defaults.
This allows the operator to change how many and how frequently ads are injected across the entire user base without pushing an extension update.
| Content-Type | application/json |
The fetchAppConfig Chrome alarm fires every 10 minutes from extension startup, polling for updated ad injection limits from the operator's server.
pn(), remote config fetch and application (background.js)
const pn = async function() {
const resp = await Tr(
'https://api.addslice.com/v1/apps/me/config?version=' + k(),
{ headers: { 'Content-Type': 'application/json' } }
);
if (resp.status !== 200) return;
const data = await resp.json();
let limits = zr.ADLIMITS; // hardcoded defaults
if ('adLimits' in data.data) {
limits = data.data.adLimits; // server overrides defaults
}
try { f('adLimits', limits); } catch (e) {} // stored in extension storage
};
// Alarm registration (background.js line 12322):
chrome.alarms.create('fetchAppConfig', { periodInMinutes: 10 });The `adLimits` object controls per-day caps and injection frequency intervals for five ad types: banner, native, push, click, and affiliate. Changes take effect within 10 minutes for all users without requiring an extension update or any user notification. The hardcoded defaults in `zr.ADLIMITS` serve only as a fallback when the remote endpoint is unreachable.