Is Surfe.be — the extension with which you earn safe?

Medium risk

Surfe.be is medium risk. DA captured 12 POSTs to surfe.be/ext-v2/auth with the base64-encoded URL of every tab visited. Chrome shows no consent prompt; Firefox's opt-in dialog does. URLs go with account tokens, linking browsing history to the account.

Dave Modisv1.8.2Chrome Web Store
45Risk
Who publishes it

Dave Modis - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Dave Modis
Website
surfe.be/help

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Visited URLs base64-encoded and sent to surfe.be on every page load

DA captured 12 POSTs to surfe.be/ext-v2/auth with the base64-encoded URL of every tab visited.

Chrome shows no consent prompt; Firefox's opt-in dialog does.

URLs go with account tokens, linking browsing history to the account.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
Why you can't catch this in DevTools
Decoded value
https://www.google.com/account/about/?hl=en-US
Captured request
POSThttps://surfe.be/ext-v2/auth?ver=182
Headers
Content-Type
application/x-www-form-urlencoded
Body
href=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9hY2NvdW50L2Fib3V0Lz9obD1lbi1VUw==
Observation

On Chrome, no consent prompt is shown before this data collection begins. The extension's source code contains a privacy opt-in dialog (popup.js, `privacy_optin`), but it is only triggered when `'browser_specific_settings' in chrome.runtime.getManifest` evaluates to true — a condition that is false on Chrome MV3 manifests. The opt-in logic in content.js uses a similar Firefox-only guard (`'applications' in manifest`). The Chrome Web Store listing does not disclose URL collection.

What it can do

Permissions this extension asks for, as declared in version 1.8.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on surfe.be

    *://surfe.be/* and 1 more

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Updated 30 September 2026manjolceoachljppbjhfgkoomnlidkna