Is TikTok Pixel Helper safe?

Medium risk

TikTok Pixel Helper is medium risk. Installing TikTok Pixel Helper generates a permanent profile ID sent to TikTok's ad servers with your tab URL, OS, browser and timezone, resent on each popup open/close via ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log.

TikTok For Businessv3.0.3Chrome Web Store
50Risk
Who publishes it

TikTok For Business - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

TikTok Pixel Helper sends persistent device ID and tab URL to TikTok

Installing TikTok Pixel Helper generates a permanent profile ID sent to TikTok's ad servers with your tab URL, OS, browser and timezone, resent on each popup open/close via ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install TikTok Pixel Helper or close its popup panel.

The extension fires a telemetry request on the Helper_Install event at install and on the Helper_Duration event when the popup is closed.

The extension did this

The background service worker posts a JSON payload to ads.tiktok.com containing a permanent identifier tied to your browser profile and the URL of the tab you currently have open.

The identifier is generated once at install and never rotated; it appears in both the JSON body (user_unique_id) and the X-Helper-Token request header on every subsequent telemetry call.

Captured request
POSThttps://ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log

{"code":0,"message":"OK","data":"SendLogSuccess"}

Headers
Content-Type
application/json
X-Helper-Token
tt_yPv1L2KJfMQXaignHfFzdPHE
Body
{  "mario_events": {    "header": {      "app_id": 422245,      "app_name": "TikTok Pixel Helper",      "app_version": "3.0.3",      "os_name": "linux",      "os_version": "",      "device_model": "Linux x86_64",      "language": "en-US",      "timezone": 0,      "tz_offset": 0,      "browser": "Google Chrome",      "browser_version": "",      "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"    },    "events": [      {        "event": "Helper_Popup_Show",        "local_time_ms": 1751068800000,        "time": 1751068800,        "session_id": "sessionId-a3f9b2c04d78e1f6-1751068800000",        "is_bav": 0,        "params": "{\"event_index\":1,\"page_url\":\"https://example.com/dashboard\" (illustrative),\"time\":1751068800000}"      },      {        "event": "Helper_FCP",        "local_time_ms": 1751068800120,        "time": 1751068800,        "session_id": "sessionId-a3f9b2c04d78e1f6-1751068800000",        "is_bav": 0,        "params": "{\"event_index\":2,\"page_url\":\"https://example.com/dashboard\" (illustrative),\"time\":1751068800120}"      }    ]  },  "user_unique_id": "tt_yPv1L2KJfMQXaignHfFzdPHE"}
Fields transmitted in every telemetry request body
  • Persistent browser identifier
    tt_yPv1L2KJfMQXaignHfFzdPHE

    A permanent ID from install that links every telemetry request to your profile. In both body and X-Helper-Token header; never rotated.

  • Current tab URL
    https://example.com/dashboard (illustrative)

    The full URL of your open tab when telemetry fires. Any page, not only ones related to TikTok ads.

  • Operating system
    linux / Linux x86_64

    Your OS platform name and version, contributing to a device fingerprint alongside your browser details.

  • Browser name and user agent
    Google Chrome / Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36...

    Your browser name and full user agent string, which reveals browser version and rendering engine.

  • Language and timezone
    en-US / UTC+0

    Your browser's configured language and your UTC offset, which together narrow your geographic location.

  • Session identifier
    sessionId-a3f9b2c04d78e1f6-1751068800000

    A per-browser-session token that groups events within one browsing session into a sequence.

What's stored on your device

Written to storage under _luik at install, read every call. Also set as a 30-day cookie _euk on ads.tiktok.com.

Location
chrome.storage.local key '_luik'; copy as cookie '_euk' on https://ads.tiktok.com
Contents
tt_yPv1L2KJfMQXaignHfFzdPHE
The code that does this

Telemetry dispatch function l(), background.js

Readable version
// '_luik' = storage key for the persistent user identifier// 'a' is the constant '_luik' in the enclosing closureconst sendTelemetry = async (events) => {  try {    // Read the permanent identifier from local storage    const persistentId = (await chrome.storage.local.get('_luik'))['_luik'] || '';    const platformInfo = await chrome.runtime.getPlatformInfo();    const userAgent = navigator.userAgent;    const manifest = chrome.runtime.getManifest();    // Build device fingerprint header    const deviceHeader = {      app_id: 422245,                              // hard-coded TikTok advertising app ID      app_name: 'TikTok Pixel Helper',      app_version: manifest.version,      os_name: platformInfo.os,      os_version: getOsVersion(platformInfo.os, userAgent),      device_model: navigator.platform || 'Unknown',      language: navigator.language,      timezone: -(new Date().getTimezoneOffset() / 60),      tz_offset: 60 * new Date().getTimezoneOffset(),      browser: getBrowserName(userAgent),      browser_version: '',      user_agent: userAgent    };    // POST to TikTok advertising telemetry endpoint    // persistentId appears in BOTH the body (user_unique_id)    // AND the X-Helper-Token header    fetch('https://ads.tiktok.com/i18n/events_manager/v2/api/pixel_helper/log', {      method: 'POST',      headers: {        'Content-Type': 'application/json',        'X-Helper-Token': persistentId      },      body: JSON.stringify({        mario_events: { header: deviceHeader, events: events },        user_unique_id: persistentId      })    });  } catch {}};
Telemetry destination
    • ads.tiktok.com

    TikTok advertising platform. Receives the persistent browser identifier, current tab URL, and device fingerprint on install and each popup interaction. Operated by ByteDance Ltd.

What it can do

Permissions this extension asks for, as declared in version 3.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.0.3, which we have not unpacked yet.

  • Read and change your data on every site you visit

    <all_urls>

  • Watch every request your browser makes

    webRequest

  • See the address and title of every tab you have open

    tabs

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026aelgobmabdmlfmiblddjfnjodalhidnn