Is TikTok Pixel Helper safe?
TikTok Pixel Helper is medium risk. Installing TikTok Pixel Helper generates a permanent profile ID sent to TikTok's ad servers with your tab URL, OS, browser and timezone, resent on each popup open/close via ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log.
Who publishes itTikTok For Business - no other listings under this identity
TikTok For Business - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
TikTok Pixel Helper sends persistent device ID and tab URL to TikTok
Installing TikTok Pixel Helper generates a permanent profile ID sent to TikTok's ad servers with your tab URL, OS, browser and timezone, resent on each popup open/close via ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install TikTok Pixel Helper or close its popup panel.
The extension fires a telemetry request on the Helper_Install event at install and on the Helper_Duration event when the popup is closed.
The background service worker posts a JSON payload to ads.tiktok.com containing a permanent identifier tied to your browser profile and the URL of the tab you currently have open.
The identifier is generated once at install and never rotated; it appears in both the JSON body (user_unique_id) and the X-Helper-Token request header on every subsequent telemetry call.
{"code":0,"message":"OK","data":"SendLogSuccess"}
- Content-Type
- application/json
- X-Helper-Token
- tt_yPv1L2KJfMQXaignHfFzdPHE
{ "mario_events": { "header": { "app_id": 422245, "app_name": "TikTok Pixel Helper", "app_version": "3.0.3", "os_name": "linux", "os_version": "", "device_model": "Linux x86_64", "language": "en-US", "timezone": 0, "tz_offset": 0, "browser": "Google Chrome", "browser_version": "", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" }, "events": [ { "event": "Helper_Popup_Show", "local_time_ms": 1751068800000, "time": 1751068800, "session_id": "sessionId-a3f9b2c04d78e1f6-1751068800000", "is_bav": 0, "params": "{\"event_index\":1,\"page_url\":\"https://example.com/dashboard\" (illustrative),\"time\":1751068800000}" }, { "event": "Helper_FCP", "local_time_ms": 1751068800120, "time": 1751068800, "session_id": "sessionId-a3f9b2c04d78e1f6-1751068800000", "is_bav": 0, "params": "{\"event_index\":2,\"page_url\":\"https://example.com/dashboard\" (illustrative),\"time\":1751068800120}" } ] }, "user_unique_id": "tt_yPv1L2KJfMQXaignHfFzdPHE"}- Persistent browser identifiertt_yPv1L2KJfMQXaignHfFzdPHE
A permanent ID from install that links every telemetry request to your profile. In both body and X-Helper-Token header; never rotated.
- Current tab URLhttps://example.com/dashboard (illustrative)
The full URL of your open tab when telemetry fires. Any page, not only ones related to TikTok ads.
- Operating systemlinux / Linux x86_64
Your OS platform name and version, contributing to a device fingerprint alongside your browser details.
- Browser name and user agentGoogle Chrome / Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36...
Your browser name and full user agent string, which reveals browser version and rendering engine.
- Language and timezoneen-US / UTC+0
Your browser's configured language and your UTC offset, which together narrow your geographic location.
- Session identifiersessionId-a3f9b2c04d78e1f6-1751068800000
A per-browser-session token that groups events within one browsing session into a sequence.
Written to storage under _luik at install, read every call. Also set as a 30-day cookie _euk on ads.tiktok.com.
- Location
- chrome.storage.local key '_luik'; copy as cookie '_euk' on https://ads.tiktok.com
tt_yPv1L2KJfMQXaignHfFzdPHETelemetry dispatch function l(), background.js
// '_luik' = storage key for the persistent user identifier// 'a' is the constant '_luik' in the enclosing closureconst sendTelemetry = async (events) => { try { // Read the permanent identifier from local storage const persistentId = (await chrome.storage.local.get('_luik'))['_luik'] || ''; const platformInfo = await chrome.runtime.getPlatformInfo(); const userAgent = navigator.userAgent; const manifest = chrome.runtime.getManifest(); // Build device fingerprint header const deviceHeader = { app_id: 422245, // hard-coded TikTok advertising app ID app_name: 'TikTok Pixel Helper', app_version: manifest.version, os_name: platformInfo.os, os_version: getOsVersion(platformInfo.os, userAgent), device_model: navigator.platform || 'Unknown', language: navigator.language, timezone: -(new Date().getTimezoneOffset() / 60), tz_offset: 60 * new Date().getTimezoneOffset(), browser: getBrowserName(userAgent), browser_version: '', user_agent: userAgent }; // POST to TikTok advertising telemetry endpoint // persistentId appears in BOTH the body (user_unique_id) // AND the X-Helper-Token header fetch('https://ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Helper-Token': persistentId }, body: JSON.stringify({ mario_events: { header: deviceHeader, events: events }, user_unique_id: persistentId }) }); } catch {}};- ads.tiktok.com
TikTok advertising platform. Receives the persistent browser identifier, current tab URL, and device fingerprint on install and each popup interaction. Operated by ByteDance Ltd.
What it can do
Permissions this extension asks for, as declared in version 3.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.0.3, which we have not unpacked yet.
Read and change your data on every site you visit
<all_urls>
Watch every request your browser makes
webRequest
See the address and title of every tab you have open
tabs
See every page you navigate to, as you navigate to it
webNavigation
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Read and change cookies, including the ones that keep you signed in
cookies
Run its own code inside the pages you visit
scripting