Am I Being Pwned?
Get started

Is Spy Essentials safe?

Medium risk

Spy Essentials applies server-supplied proxy rules that can route selected browsing traffic through its proxies.

The extension fetches per-domain proxy settings from login.spyessentials.ai and applies them when tab URLs change, allowing configured domains to use a fixed proxy. Its content script also sends each visited hostname to login.spyessentials.ai for CSS rules, and page-controlled click handlers can ask the extension to set cookies and open a target URL.

spyessentialsteamv20.0.0Chrome Web Store
50Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends the hostname of every site you open to login.spyessentials.ai

MediumunwantedCWE-359Dynamic sandbox

On every page you load, the extension requests a stylesheet from login.spyessentials.ai with the site's hostname in the URL.

What actually happens

You did this

You open any website, such as en.wikipedia.org.

The extension did this

The extension sends that site's hostname to login.spyessentials.ai.

No click or other action is needed.

Captured request

GEThttps://login.spyessentials.ai/cook/style.php?domain=en.wikipedia.org

Stylesheet text; the script injects it into the page unless the reply is the 'No custom styles available' placeholder.

What the request carries

  • Site you visited
    en.wikipedia.org

    Tells the server which site you opened, building a visit log.

  • Your IP address
    Visible to server

    Any request reveals your network address to the server.

The code that does this

The request in the content script

Readable version

Same code (not obfuscated)

src/content.js
const hostname = window.location.hostname;const url = `https://login.spyessentials.ai/cook/style.php?domain=${hostname}`;const response = await fetch(url);const css = await response.text();if (css.trim() !== "/* No custom styles available for this domain */") {  const style = document.createElement("style");  style.innerHTML = css;  document.head.appendChild(style);}

Where the hostname goes

    • login.spyessentials.ai

    Receives the hostname of each visited site and returns CSS.

What it can do

Permissions this extension asks for, as declared in version 20.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Schedule its own background tasks

    alarms

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Route all of your browsing through a server of its choosing

    proxy

  • Watch every request your browser makes

    webRequest

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

  • Run its own code inside the pages you visit

    scripting

webRequestAuthProvider

Where it sends data

Destinations our analysis observed Spy Essentials contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • login.spyessentials.ai

    Spy Essentials sends data to login.spyessentials.ai. No other extension we have analyzed sends data here.

Updated 2 November 2026ioeofgkpnkablpdeibafbhihapppjobj