Is Tefaş TradingView (fonnksiyon) safe?

High risk

The extension sends TEFAS portfolio and fund activity events to Google Analytics.

When users create orders or transactions, it forwards fund codes, order or transaction type, amount, price, and share count, along with a persistent client ID, page URL, and page title. It also sends chart activity such as opened funds, session end, mode changes, indicators, drawings, and fund comparisons.

fonnksiyonv1.1.9Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

TEFAS portfolio activity sent to Google Analytics

When you use TEFAS portfolio and chart features, the extension sends Google Analytics requests with the page URL, title, a persistent client ID, and events like fund code, order direction, amount, quantity, price, and chart indicators.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You save a TEFAS portfolio order or transaction, or interact with the fund chart.

The extension did this

The extension sends the TEFAS page context and fund-action details to Google Analytics with a persistent identifier.

Dynamic analysis confirmed the Google Analytics collection path, and source review shows the exact event fields attached to those requests.

Captured request
GEThttps://www.google-analytics.com/g/collect?v=2&tid=G-0CDCQ156Y5&cid=4f4d7a89-23e4-44ac-9f7e-8f46d4b65045&en=hareket_ekle&dl=https%3A%2F%2Fwww.tefas.gov.tr%2FFonAnaliz.aspx%3FFonKod%3DAFA&dt=TEFAS%20Fon%20Analiz&ep.fon_kodu=AFA&ep.tur=alis&ep.adet=10&ep.fiyat=42.35&sid=1783982265&sct=1&_s=1&_et=0&_p=123456789&seg=1&_ss=1&_dbg=1

Google Analytics collection request; no request body was recorded for this claim.

Fields sent in the Google Analytics query
  • Analytics property
    G-0CDCQ156Y5

    Identifies the Google Analytics property that receives the event.

  • Browser client identifier
    4f4d7a89-23e4-44ac-9f7e-8f46d4b65045

    Lets events from the same browser profile be linked over time.

  • Current TEFAS page
    https://www.tefas.gov.tr/FonAnaliz.aspx?FonKod=AFA

    Shows which TEFAS fund page or tool was open when the event was sent.

  • Event name
    hareket_ekle

    Describes the portfolio or chart action you performed.

  • Portfolio order fields
    fon_kodu=AFA, tur=alis, adet=10, fiyat=42.35

    Carries fund activity such as fund code, buy or sell direction, amount, quantity, and price.

  • Chart interaction fields
    indicator_name=Moving Average, fon_kodu=AFA

    Records chart usage such as opened funds, added indicators, drawing types, currency-mode changes, and comparison funds.

The code that does this

Portfolio and chart events are forwarded into the analytics sender

Readable version

Readable equivalent of the stored identifier and GA request builder

assets/main.js-CKVCf0bL.js
async function getGoogleAnalyticsClientId() {  if (cachedClientId) return cachedClientId;  try {    const stored = await chrome.storage.local.get(["ga_client_id"]);    if (stored.ga_client_id) {      cachedClientId = stored.ga_client_id;    } else {      cachedClientId = crypto.randomUUID();      await chrome.storage.local.set({ ga_client_id: cachedClientId });    }  } catch {    if (!cachedClientId) cachedClientId = crypto.randomUUID();  }  return cachedClientId;}async function sendAnalyticsEvent(eventName, eventParams) {  try {    attemptedAnalyticsEvents++;    await loadAnalyticsSession();    const clientId = await getGoogleAnalyticsClientId();    const url = new URL("https://www.google-analytics.com/g/collect");    url.searchParams.set("v", "2");    url.searchParams.set("tid", analyticsMeasurementId);    url.searchParams.set("cid", clientId);    url.searchParams.set("en", eventName);    url.searchParams.set("dl", window.location.href);    url.searchParams.set("dt", document.title || "Tefaş TradingView");    if (eventParams) {      for (const [name, value] of Object.entries(eventParams)) {        if (value != null) url.searchParams.set("ep." + name, String(value));      }    }    const session = nextAnalyticsSessionFields();    url.searchParams.set("sid", String(session.sid));    url.searchParams.set("sct", String(session.sct));    url.searchParams.set("_s", String(session._s));    url.searchParams.set("_et", String(session._et));    url.searchParams.set("_p", String(session._p));    url.searchParams.set("seg", "1");    if (session._ss) url.searchParams.set("_ss", "1");    if (debugAnalytics) url.searchParams.set("_dbg", "1");    const requestUrl = url.toString();    let sent = false;    if (navigator.sendBeacon) sent = navigator.sendBeacon(requestUrl);    if (!sent) {      fetch(requestUrl, { method: "GET", mode: "no-cors", keepalive: true }).catch(() => {});      sent = true;    }  } catch (error) {    if (error.message && error.message.includes("Extension context invalidated")) return;    console.error("Analytics hatası:", error);  }}document.addEventListener("analytics", event => {  sendAnalyticsEvent(event.detail.eventName, event.detail.eventParams);});document.addEventListener("_analyticsForward", event => {  try {    sendAnalyticsEvent(event.detail.eventName, event.detail.eventParams);  } catch {}});
External recipient
    • www.google-analytics.com

    Receives GA4 collection requests containing TEFAS page context, persistent client ID, event names, and event-specific portfolio or chart fields.

Where it sends data

Destinations our analysis observed Tefaş TradingView (fonnksiyon) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Tefaş TradingView (fonnksiyon) sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026domlgeadkkpboffeaileonejbnmfjgcb