Is TopCashback USA Get Cash Back & Coupons safe?

Medium risk

TopCashback is medium risk. Code analysis shows the SDK serializes the full page DOM and posts it with the URL and title to api.onsleek.ai. Allowlisted sites and feature flags are set remotely.

v7.14.0.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sleek SDK uploads page HTML, URL and title to api.onsleek.ai

Code analysis shows the SDK serializes the full page DOM and posts it with the URL and title to api.onsleek.ai.

Allowlisted sites and feature flags are set remotely.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page on a site that the remote allowlist marks for page classification.

The extension did this

The extension sends the page's full HTML, address and title to api.onsleek.ai.

The same capture feeds product extraction, coupon agent and order extraction requests.

The code that does this

Capture and upload path in mf.js

Readable version

DOM capture including iframes

mf.js
captureDomString = async (a = !0, e = !0) => {  const o = this.sdkOptionsService.getOptions().cssSelectorsToSkipCapture ?? [],    t = Array.from(document.querySelectorAll("iframe")),    i = await G.Promise.allSettled(t.map(async t => ({      domString: await this.pingPrepFrame(t, t => this.frameScriptCaller.call(t, "captureDom", { timeoutMs: 200, schema: k() }, o, a, e)),      frame: t    }))),    s = new Map(i.filter(a => "fulfilled" === a.status).map(({ value: { frame: a, domString: e } }) => [a, e ?? ""])),    n = S(document.documentElement, o, a, e, s);  if (!n || n.nodeType !== G.Node.ELEMENT_NODE) throw new Error("Failed to capture DOM string");  return n.outerHTML.replace(/>\s+</g, "><")

Coupon agent upload

mf.js
const o = await this.sleekApiService.postCouponAgent({  domString: await this.rpcService.captureDomString(),  urlString: G.window.location.href,  title: document.title,  codes: a,  userAgent: G.navigator.userAgent});

Request headers

mf.js
const m = {  Authorization: `Bearer ${this.apiKey}`,  "x-sleek-sdk-version": Z};
Fields in the page-classification POST body
  • Page HTML
    domString: "<html><head>...</head><body>...</body></html>"

    The serialized document, including embedded iframe content.

  • Page address
    urlString: "https://www.example-shop.com/cart"

    The full URL of the page you are on.

  • Page title
    title: "Your Cart (2 items)"

    The title of the page.

Endpoints that receive the captured DOM
    • api.onsleek.ai

    Receives page classification, product and order extraction, and coupon agent requests with page HTML.

Scope and gating

Requests occur only for sites whose allowlist entry enables the feature, and only when the remote SleekEnabled flag is on. Both are set by the vendor's servers. We did not observe the upload dynamically.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 15 October 2026lkmpdpkkkeeoiodlnmlichcmfmdjbjic