Is TopCashback Browser Extension Australia safe?

Medium risk

TopCashback is medium risk. Code analysis shows the coupon feature sends the page's HTML, URL and title to api.onsleek.ai during checkout coupon checks. This applies on merchant pages the Sleek allowlist covers.

v7.14.0.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sleek coupon SDK sends the full page HTML, URL and title to api.onsleek.ai

Code analysis shows the coupon feature sends the page's HTML, URL and title to api.onsleek.ai during checkout coupon checks.

This applies on merchant pages the Sleek allowlist covers.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You start applying coupons on a supported merchant checkout or product page.

The extension did this

The extension sends the page's HTML, address and title to api.onsleek.ai.

The code that does this

Coupon auto-apply upload

Readable version
mf.js
async startCouponAutoApply(codes) {  const site = await allowlist.getAllowlistWebsiteForUrl(location.href);  if (!site?.couponAutoApplyEnabled) throw new Error('not enabled');  const reply = await sleekApi.postCouponAgent({    domString: await rpc.captureDomString(),  // whole document HTML + iframe HTML    urlString: location.href,    title: document.title,    codes,    userAgent: navigator.userAgent  });}
The code that does this

DOM capture used by the upload

Readable version
mf.js
async captureDomString(a, e) {  const skip = options.cssSelectorsToSkipCapture ?? [];  const frames = [...document.querySelectorAll('iframe')];  const frameDoms = await Promise.allSettled(frames.map(f => callFrameScript(f, 'captureDom', skip, a, e)));  const root = mergeFrames(document.documentElement, skip, a, e, frameDoms);  return root.outerHTML.replace(/>\s+</g, '><');}
Fields posted to /v3/coupon-agent
  • domString
    <html><body><form id="checkout">...</form></body></html>

    The page's full HTML, which can include names, addresses and cart contents.

  • urlString
    https://shop.example.com/checkout

    The address of the page you are on.

  • title
    Checkout | Example Shop

    The title of the page.

  • codes
    ["SAVE10","WELCOME5"]

    The coupon codes the extension will try.

  • userAgent
    Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130.0.0.0

    Describes your browser and operating system.

Where the page content goes
    • api.onsleek.ai

    Sleek coupon agent API; receives page HTML, URL and title, authenticated with a Bearer key built into the extension.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 15 October 2026opokhjaclibdclfeckdodnjmhblhdfnn