Is Slice - You browse. We pay. safe?

High risk

Slice is high risk. On every page visited, Slice sends the full URL to pal.sli.ce.it/fetch_slice.php, a VAST ad server, with a persistent per-install ID (appUuid) enabling cross-session tracking. 23 POSTs seen in one session, plus a marker confirming URL sent.…

lolli-extensionv1.4.4Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Page URLs Forwarded to VAST Ad Server on Every Visit

On every page visited, Slice sends the full URL to pal.sli.ce.it/fetch_slice.php, a VAST ad server, with a persistent per-install ID (appUuid) enabling cross-session tracking. 23 POSTs seen in one session, plus a marker confirming URL sent.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to any HTTPS page while Slice is installed and active.

The extension did this

Slice POSTs your full page URL and a persistent per-install UUID to pal.sli.ce.it/fetch_slice.php to retrieve a VAST video ad.

The UUID (appUuid) ties this request to your specific installation across all pages and sessions, allowing the VAST server to build a cross-site browsing profile.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://pal.sli.ce.it/fetch_slice.php
Returns a VAST XML document containing video ad media URLs and tracking event endpoints.
Body
{
  "url": "https://en.wikipedia.org/wiki/<page>",
  "appUuid": "807601247301573382",
  "version": "1.4.4"
}
03EvidenceFIELD TABLE
What Slice sends to pal.sli.ce.it on every page visit:
FieldValueWhy it matters
Page URL
https://en.wikipedia.org/wiki/Privacy_lawsThe full address of the current page, including path and query parameters.
App UUID
807601247301573382A persistent numeric ID unique to your Slice install. Sent with every request, letting the server track pages across sessions.
Extension version
1.4.4Which version of Slice is installed.
04EvidenceCODE COMPARE
The code that does this

nn(), URL + UUID transmission to VAST server (background.js)

What it actually does
background.js line 11517 — nn() retrieves UUID and POSTs URLbackground.js
const nn = async function(pageUrl) {
  const appUuid = await ur();    // persistent per-install identifier
  const version = k();           // extension version
  let adData = { title: '', description: '', url: '', events: [], media: { url: '' } };

  const response = await tn('https://pal.sli.ce.it/fetch_slice.php', {
    method: 'POST',
    body: JSON.stringify({
      url: pageUrl,   // full page URL from content script
      appUuid,        // persistent install UUID
      version         // extension version
    })
  });
  // ... parse VAST XML response ...
};
05EvidenceTHIRD PARTY LIST
VAST ad server receiving browsing URLs and install UUID:
  • pal.sli.ce.it

    Slice VAST video ad server. Receives the full URL of every page visited alongside a persistent per-install UUID. Operated by AddSlice.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Browsed URLs Sent to Ad Server on Every Page Visit

Every page you navigate to has its full URL, path and query string included, sent to api.sli.ce.it/v1/ads/native for targeted ads.

Every HTTPS page, plus your app version, reaches Slice's ad infrastructure. 23 POSTs seen in one session.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to any HTTPS page while Slice is installed and active.

The extension did this

Slice transmits the full URL of that page to api.sli.ce.it/v1/ads/native to fetch a targeted ad.

This occurs automatically on every page load and SPA navigation, with no user interaction required beyond having the extension installed.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.sli.ce.it/v1/ads/native
Returns ad content (image URL, click tracking, HTML template) for injection into the current page.
Headers
Content-Typeapplication/json
Body
{
  "appTaxonomies": {},
  "version": "1.4.4",
  "url": "https://en.wikipedia.org/wiki/<page>",
  "isOverlay": true,
  "returnImageAsURL": true
}
03EvidenceFIELD TABLE
What Slice sends to its ad server on every page visit:
FieldValueWhy it matters
Page URL
https://en.wikipedia.org/wiki/Privacy_lawsThe full address of the page you are viewing, including the path and any search parameters.
Extension version
1.4.4Which version of Slice you have installed.
Ad taxonomy context
{}A structured object (appTaxonomies) sent alongside the URL for ad targeting classification.
04EvidenceCODE COMPARE
The code that does this

URL capture and transmission in content.js and background.js

What it actually does
content.js line 1607 — URL assemblycontent.js
r = new URL(window.location.href);
n = "".concat(r.origin).concat(r.pathname).concat(r.search);
// ... then:
chrome.runtime.sendMessage({ type: "getNative", url: n, isOverlay: true });
background.js lines 10851-10868 — Sr() sends URL to ad APIbackground.js
Sr = async function(t, r) {
  await Tr("https://api.sli.ce.it/v1/ads/native", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      appTaxonomies: {},
      version: k(),
      url: t,        // full page URL from content script
      isOverlay: r,
      returnImageAsURL: true
    })
  });
};
05EvidenceTHIRD PARTY LIST
Ad infrastructure receiving browsing URLs:
  • api.sli.ce.it

    Slice ad server. Receives full page URL on every navigation to serve targeted ads. Operated by AddSlice.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Remote Config Controls Ad Injection Rates for All Users

Slice polls api.addslice.com/v1/apps/me/config every 10 min for ad limits governing daily banner, native, push, click, and affiliate ad volume.

The server can change this for all users with no update or notice.

Three GETs in 726 seconds.

01EvidenceCAUSE EFFECT
What actually happens
You did this

Every 10 minutes, a Chrome alarm named 'fetchAppConfig' fires in the background service worker.

The extension did this

The operator's server at api.addslice.com returns an adLimits object that overwrites the extension's hardcoded ad-injection defaults.

This allows the operator to change how many and how frequently ads are injected across the entire user base without pushing an extension update.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://api.addslice.com/v1/apps/me/config?version=1.4.4
Returns JSON with data.adLimits containing per-day caps and interval settings for banner, native, push, click, and affiliate ad types.
Headers
Content-Typeapplication/json
03EvidenceTEMPORAL PATTERN
When this fires
Every 10 minutes

The fetchAppConfig Chrome alarm fires every 10 minutes from extension startup, polling for updated ad injection limits from the operator's server.

04EvidenceCODE COMPARE
The code that does this

pn(), remote config fetch and application (background.js)

What it actually does
background.js line 12039 — pn() polls remote config and applies adLimitsbackground.js
const pn = async function() {
  const resp = await Tr(
    'https://api.addslice.com/v1/apps/me/config?version=' + k(),
    { headers: { 'Content-Type': 'application/json' } }
  );
  if (resp.status !== 200) return;

  const data = await resp.json();
  let limits = zr.ADLIMITS;                    // hardcoded defaults
  if ('adLimits' in data.data) {
    limits = data.data.adLimits;               // server overrides defaults
  }
  try { f('adLimits', limits); } catch (e) {} // stored in extension storage
};

// Alarm registration (background.js line 12322):
chrome.alarms.create('fetchAppConfig', { periodInMinutes: 10 });
05EvidencePLAIN NOTE
What the operator can change remotely

The `adLimits` object controls per-day caps and injection frequency intervals for five ad types: banner, native, push, click, and affiliate. Changes take effect within 10 minutes for all users without requiring an extension update or any user notification. The hardcoded defaults in `zr.ADLIMITS` serve only as a fallback when the remote endpoint is unreachable.

Updated 10 September 2026bdjlgibhgpkkohcmkdeknhggojiokgmj