Is Slice - You browse. We pay. safe?
Slice is high risk. On every page visited, Slice sends the full URL to pal.sli.ce.it/fetch_slice.php, a VAST ad server, with a persistent per-install ID (appUuid) enabling cross-session tracking. 23 POSTs seen in one session, plus a marker confirming URL sent.…
Who publishes itThesis, Inc - no other listings under this identity, 3 shared hostnames
Thesis, Inc - no other listings under this identity, 3 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page URLs Forwarded to VAST Ad Server on Every Visit
On every page visited, Slice sends the full URL to pal.sli.ce.it/fetch_slice.php, a VAST ad server, with a persistent per-install ID (appUuid) enabling cross-session tracking. 23 POSTs seen in one session, plus a marker confirming URL sent.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any HTTPS page while Slice is installed and active.
Slice POSTs your full page URL and a persistent per-install UUID to pal.sli.ce.it/fetch_slice.php to retrieve a VAST video ad.
The UUID (appUuid) ties this request to your specific installation across all pages and sessions, allowing the VAST server to build a cross-site browsing profile.
Returns a VAST XML document containing video ad media URLs and tracking event endpoints.
{ "url": "https://en.wikipedia.org/wiki/<page>", "appUuid": "807601247301573382", "version": "1.4.4"}- Page URLhttps://en.wikipedia.org/wiki/Privacy_laws
The full address of the current page, including path and query parameters.
- App UUID807601247301573382
A persistent numeric ID unique to your Slice install. Sent with every request, letting the server track pages across sessions.
- Extension version1.4.4
Which version of Slice is installed.
nn(), URL + UUID transmission to VAST server (background.js)
background.js line 11517 — nn() retrieves UUID and POSTs URL
background.jsconst nn = async function(pageUrl) { const appUuid = await ur(); // persistent per-install identifier const version = k(); // extension version let adData = { title: '', description: '', url: '', events: [], media: { url: '' } }; const response = await tn('https://pal.sli.ce.it/fetch_slice.php', { method: 'POST', body: JSON.stringify({ url: pageUrl, // full page URL from content script appUuid, // persistent install UUID version // extension version }) }); // ... parse VAST XML response ...};- pal.sli.ce.it
Slice VAST video ad server. Receives the full URL of every page visited alongside a persistent per-install UUID. Operated by AddSlice.
Browsed URLs Sent to Ad Server on Every Page Visit
Every page you navigate to has its full URL, path and query string included, sent to api.sli.ce.it/v1/ads/native for targeted ads.
Every HTTPS page, plus your app version, reaches Slice's ad infrastructure. 23 POSTs seen in one session.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any HTTPS page while Slice is installed and active.
Slice transmits the full URL of that page to api.sli.ce.it/v1/ads/native to fetch a targeted ad.
This occurs automatically on every page load and SPA navigation, with no user interaction required beyond having the extension installed.
Returns ad content (image URL, click tracking, HTML template) for injection into the current page.
- Content-Type
- application/json
{ "appTaxonomies": {}, "version": "1.4.4", "url": "https://en.wikipedia.org/wiki/<page>", "isOverlay": true, "returnImageAsURL": true}- Page URLhttps://en.wikipedia.org/wiki/Privacy_laws
The full address of the page you are viewing, including the path and any search parameters.
- Extension version1.4.4
Which version of Slice you have installed.
- Ad taxonomy context{}
A structured object (appTaxonomies) sent alongside the URL for ad targeting classification.
URL capture and transmission in content.js and background.js
content.js line 1607 — URL assembly
content.jsr = new URL(window.location.href);n = "".concat(r.origin).concat(r.pathname).concat(r.search);// ... then:chrome.runtime.sendMessage({ type: "getNative", url: n, isOverlay: true });background.js lines 10851-10868 — Sr() sends URL to ad API
background.jsSr = async function(t, r) { await Tr("https://api.sli.ce.it/v1/ads/native", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ appTaxonomies: {}, version: k(), url: t, // full page URL from content script isOverlay: r, returnImageAsURL: true }) });};- api.sli.ce.it
Slice ad server. Receives full page URL on every navigation to serve targeted ads. Operated by AddSlice.
Remote Config Controls Ad Injection Rates for All Users
Slice polls api.addslice.com/v1/apps/me/config every 10 min for ad limits governing daily banner, native, push, click, and affiliate ad volume.
The server can change this for all users with no update or notice.
Three GETs in 726 seconds.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
Every 10 minutes, a Chrome alarm named 'fetchAppConfig' fires in the background service worker.
The operator's server at api.addslice.com returns an adLimits object that overwrites the extension's hardcoded ad-injection defaults.
This allows the operator to change how many and how frequently ads are injected across the entire user base without pushing an extension update.
Returns JSON with data.adLimits containing per-day caps and interval settings for banner, native, push, click, and affiliate ad types.
- Content-Type
- application/json
Every 10 minutes
The fetchAppConfig Chrome alarm fires every 10 minutes from extension startup, polling for updated ad injection limits from the operator's server.
pn(), remote config fetch and application (background.js)
background.js line 12039 — pn() polls remote config and applies adLimits
background.jsconst pn = async function() { const resp = await Tr( 'https://api.addslice.com/v1/apps/me/config?version=' + k(), { headers: { 'Content-Type': 'application/json' } } ); if (resp.status !== 200) return; const data = await resp.json(); let limits = zr.ADLIMITS; // hardcoded defaults if ('adLimits' in data.data) { limits = data.data.adLimits; // server overrides defaults } try { f('adLimits', limits); } catch (e) {} // stored in extension storage};// Alarm registration (background.js line 12322):chrome.alarms.create('fetchAppConfig', { periodInMinutes: 10 });The `adLimits` object controls per-day caps and injection frequency intervals for five ad types: banner, native, push, click, and affiliate. Changes take effect within 10 minutes for all users without requiring an extension update or any user notification. The hardcoded defaults in `zr.ADLIMITS` serve only as a fallback when the remote endpoint is unreachable.