Is Talis Reading Lists Bookmarking safe?
Talis Reading Lists Bookmarking sends the URL of any site you click its toolbar on to Google Analytics with a persistent install ID.
Every time the toolbar bookmark button is clicked, on any website (not just talis.com), the extension sends that page's URL to Google Analytics along with a client ID it generates once and stores indefinitely, letting Talis correlate a given install's bookmarking activity across sites over time. When the page doesn't already contain recognizable citation data, the extension also serializes the entire page's HTML and sends it to Talis's own resource-parsers API to extract bibliographic details for the bookmark.
Who publishes itTalis Education Ltd - 1 other listing from the same operator, none carrying a finding
Talis Education Ltd - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 1 listing
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 5 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Talis Reading Lists sends every page you bookmark to Google Analytics
Clicking the extension's toolbar icon on any website, not just Talis reading lists, sends that page's full URL to Google Analytics along with a permanent random ID, tying your bookmarking clicks together across sites over time.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You click the Talis extension's toolbar icon while viewing any webpage.
This works the same whether the page is a Talis reading list or an unrelated site like a news article or Wikipedia.
The extension sends the page's full URL to Google Analytics along with a permanent tracking ID for your install.
This happens regardless of which site you were on when you clicked.
- Page addresshttps://en.wikipedia.org/wiki/Message_passing
The full web address of whatever page you're on when you click the icon, Talis reading list or not.
- Permanent tracking ID2280c60e-c9fe-446e-80df-0509e6cf453f
A random ID created the first time you use the extension and stored forever, so every click can be linked back to the same install.
- InstitutionAston University
The school or organization you selected during setup, sent along with every click.
204 No Content (the Measurement Protocol endpoint does not echo data back)
{ "client_id": "2280c60e-c9fe-446e-80df-0509e6cf453f", "events": [ { "name": "extension_icon_clicked", "params": { "origin": "https://en.wikipedia.org/wiki/Message_passing" } } ]}extensionButtonClicked() logs the active tab's URL on every click, with no site restriction
Building a persistent client ID and firing it on every click
background.jsconst fetchClientId = async () => { const result2 = await browser.storage.local.get("clientId"); if (typeof result2.clientId === "string" && Boolean(result2.clientId)) { return result2.clientId; } const clientId = crypto.randomUUID(); await browser.storage.local.set({ clientId }); return clientId;};The click handler, run for every tab regardless of domain
background.jsconst extensionButtonClicked = async (tab) => { try { const activeTab = await getActiveTab(tab); if (!activeTab) { return; } const tenant = await retrieveTenant(); if (!tenant) { await browser.runtime.openOptionsPage(); return; } const [targetUrl] = await Promise.all([ performBookmarking(activeTab, tenant), logIconClicked(activeTab.url) ]); if (targetUrl) { await browser.tabs.update(activeTab.id, { url: targetUrl }); } } catch (error) { await logError(formatError$1(error)); }};logIconClicked() posts the URL to Google Analytics
background.jsconst logIconClicked = (url) => logEvents({ name: "extension_icon_clicked", params: { origin: url }});const send = async (model) => { const url = createGoogleAnalyticsUrl("mp/collect"); try { await fetch(url, { method: "POST", body: JSON.stringify(model) }); } catch (error) { console.debug("Error sending Google Analytics event", error); return; }};- www.google-analytics.com
Receives the page URL, permanent tracking ID, and selected institution on every toolbar click via Google's GA4 Measurement Protocol. Operated by Google, not Talis.
Where it sends data
Destinations our analysis observed Talis Reading Lists Bookmarking contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Talis Reading Lists Bookmarking sends data to www.google-analytics.com. A widely used service: 372 other extensions we have analyzed send data here.
- resource-parsers.talis.com
Talis Reading Lists Bookmarking sends data to resource-parsers.talis.com. One other extension we have analyzed sends data here.