Is Tenere safe?

Findings

const onTabActivated = async ({ tabId }) => {  resetState();  try {    const tab = await chrome.tabs.get(tabId);    if (!tab || !tab.url) return;    const domain = new URL(tab.url).hostname.replace(/^www\./, '');    if (EXCLUDED_DOMAINS.some(exc => domain.includes(exc))) return;    const result = await fetchCouponsForDomain(tabId, domain);    if (result?.coupons?.length > 0) {      // inject coupon UI into the active tab      chrome.scripting.executeScript({ target: { tabId }, files: ['contentScript/couponScript.js'] });    }  } catch {}};chrome.tabs.onActivated.addListener(onTabActivated);

async function fetchCouponsFromServer(domain) {  const url = CONFIG.api_path + 'ext/coupons/' + domain;  // → 'https://couponego.com/api/ext/coupons/' + domain  const response = await fetch(url, { mode: 'cors', method: 'GET', credentials: 'same-origin', headers: { ... } });  return response.json();}

What it can do

Permissions this extension asks for, as declared in version 2.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

• Read and change your data on every site you visit

  http://*/*

• Read and change your data on every secure site you visit

  https://*/*

• See the address and title of every tab you have open

  tabs

• Store data in your browser

  storage

• Act on the current tab, but only after you click the extension

  activeTab

• Run its own code inside the pages you visit

  scripting

• Store an unlimited amount of data in your browser

  unlimitedStorage

Where it sends data

Destinations our analysis observed Tenere contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• Google Analyticswidely used

  Tenere sends data to Google Analytics. Named as a recipient by 38 other extensions we have analyzed.