Is Smart Auto Refresh safe?

Medium risk

Smart Auto Refresh is medium risk. Smart Auto Refresh contacts a geolocation service on every load, without notice, sending your IP and getting back country, city, and postal code. Unrelated to its refresh function. Cached in synced storage, following you across devices.

Smart Auto Refresh Prov2.1.9Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Auto Refresh Extension Fetches IP Geolocation on Every Startup

MediumunwantedCWE-359Dynamic sandbox

Smart Auto Refresh contacts a geolocation service on every load, without notice, sending your IP and getting back country, city, and postal code.

What actually happens

You did this

You install or launch your browser with Smart Auto Refresh enabled.

No further interaction is required, the data collection happens before any page-refresh functionality is used.

The extension did this

The extension sends your IP address to ip-api.com and stores the returned country, city, and postal code in synced browser storage.

The fetch runs on every cold start until a cached result is present in chrome.storage.sync.

Captured request

GEThttp://ip-api.com/json

Returns JSON: {"status":"success","country":"United Kingdom","countryCode":"GB","city":"Hove","zip":"BN3","lat":50.8371,"lon":-0.1683,"isp":"BT","org":"British Telecom","query":"86.188.x.x"}

The code that does this

Geolocation fetch, service worker startup (bg.js:149-167)

Readable version
// IIFE runs immediately on service worker startup !(async function () { if (locationCache) return locationCache; // Return cached value if already stored let cached = await storageGet('location_data'); if (cached) return (locationCache = cached); // Fetch geolocation from third-party service — discloses user IP let response = await fetch('http://ip-api.com/json'); if (response) { try { response = await response.json(); } catch (e) { return; } // Store country, city, zip in synced storage country = response.countryCode; city = response.city; zip = response.zip; if (country) { storageSet({ location_data: (locationCache = { country, city, zip }) }); } } })();

Data stored in chrome.storage.sync after fetch

  • Country code
    GB

    The country your IP address resolves to, derived by ip-api.com.

  • City
    Hove

    The city associated with your IP address.

  • Postal code
    BN3

    The postal code associated with your IP address, can narrow your location to a neighbourhood.

External host receiving user IP

    • ip-api.com

    Third-party IP geolocation API. Receives the user's public IP address on every cold start and returns approximate location data. Not affiliated with the extension developer.

Why the plaintext HTTP channel matters

The request uses plain HTTP (not HTTPS), meaning the query and response are visible to any network observer between the browser and ip-api.com. The extension's use of chrome.storage.sync also means the cached location result propagates to all other devices signed into the same Chrome profile.

What it can do

Permissions this extension asks for, as declared in version 2.1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

Updated 21 September 2026fkjngjgmgbfelejhbjblhjkehchifpcj