Is SnapThePrice: Real-time Price Tracker & AI Shopping Assistant safe?

Medium risk

SnapThePrice opens a hidden affiliate redirect that includes the active tab URL.

When the side panel loads, SnapThePrice asks its background script to create an inactive tab pointing to redirect.snaptheprice.com with the current tab URL in the query string. A remote configuration from service.snaptheprice.com controls whether that redirect tab is closed automatically and how long it stays open.

SNAPTHEPRICE.COMv1.2.1Chrome Web Store
50Risk
Who publishes it

SNAPTHEPRICE CO LTD - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
SNAPTHEPRICE.COM
Declared legal entity
SNAPTHEPRICE CO LTD
Registered address
18615 Willamette Drive, West Linn, OR 97068, US
Registered contact
YU ZHUGE

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Side panel opens affiliate redirect with the active tab URL.

Opening the side panel reads the active tab URL and wraps it in a redirect to redirect.snaptheprice.com/go, sending the page you're viewing to SnapThePrice's redirect service as part of an affiliate-link flow.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the extension side panel.

The extension did this

The extension queries the active tab and opens an inactive redirect tab containing that page URL.

Captured request
GEThttps://redirect.snaptheprice.com/go
Fields in the request
  • Your active tab URL
    https://example.com/products/item (illustrative)

    This is the address of the page open in the active browser tab and is used as the redirect target.

Observation

Dynamic verification confirmed the side-panel script sends the active-aff-link message on load, and the background handler builds the redirect URL from the active tab URL.

What it can do

Permissions this extension asks for, as declared in version 1.2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Watch every request your browser makes

    webRequest

  • Schedule its own background tasks

    alarms

  • Show a panel beside the page

    sidePanel

Where it sends data

Destinations our analysis observed SnapThePrice: Real-time Price Tracker & AI Shopping Assistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • redirect.snaptheprice.com

    SnapThePrice: Real-time Price Tracker & AI Shopping Assistant sends data to redirect.snaptheprice.com. No other extension we have analysed sends data here.

  • service.snaptheprice.com

    SnapThePrice: Real-time Price Tracker & AI Shopping Assistant sends data to service.snaptheprice.com. No other extension we have analysed sends data here.

Updated 30 September 2026hlnhhamckimoaiekbglafiebkfimhapb