Is Tự động tải ảnh trên lazada safe?

Low risk

The extension opens an adpvn.co affiliate popup when downloading images from Lazada product pages.

When the user clicks the image download action on a Lazada product page, the content script opens an adpvn.co affiliate popup on the first run. The popup navigation can receive the Lazada page as the browser referrer, while the extension reads product thumbnail image URLs from the page for download.

hoangdung09x2v2.4Chrome Web Store
18Risk
Who publishes it

PhunHD - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
hoangdung09x2
Declared legal entity
PhunHD
Registered address
Thôn Rầy Ỏi, Dương Sơn, Na Rì, Bắc Kạn, Bắc Kạn 960000, VN
Registered contact
Hoàng Văn Dũng

Same store account

1 other listing published from this account, 7k+ users between them, none of them carrying a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Download Button Opens Undisclosed Affiliate Popup to adpvn.co

Clicking Download on a Lazada Vietnam page opens a new window to adpvn.co/x3dj before images are collected, confirmed by a captured request with a matching Referer header.

This happens only on the first click per session.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You click the Download button in the extension popup on a Lazada Vietnam product page.

The extension did this

The extension opens a new browser window that navigates to a third-party address, https://adpvn.co/x3dj, before collecting any product images.

This only happens on the first Download click in a given page session; later clicks in the same session open lazada.vn instead.

Captured request
GEThttps://adpvn.co/favicon.ico

200 OK. The Referer header shows the browser's active document at request time was https://adpvn.co/x3dj -- the address the extension's content script passed to window.open().

Headers
Referer
https://adpvn.co/x3dj
The code that does this

popup/js/content.js -- getLinkSanPham()

Readable version
// getLinkSanPham() = "get product link"// Called every time the popup's Download button sends {tenkey: 'GetLink'}.function getLinkSanPham() {  const thumbnailCount = document.querySelectorAll(    '.pdp-mod-common-image.item-gallery__thumbnail-image'  ).length;  // x is a module-level counter that persists for the life of this  // content-script instance (i.e. until the Lazada tab is reloaded).  if (x == 0) {    // FIRST Download click on this page load: open the affiliate popup.    window.open('https://adpvn.co/x3dj', 'Lazada', 'width=900,height=400');    x = x + 1;  } else {    // Every later click on this page load: open lazada.vn instead.    window.open('https://lazada.vn', 'Lazada', 'width=900,height=400');  }  // Regardless of which window opened, collect the product's thumbnail  // image URLs to hand back to popup.js for chrome.downloads.download().  const images = [];  for (let i = 0; i < thumbnailCount; i++) {    images.push(      document.querySelectorAll(        '.pdp-mod-common-image.item-gallery__thumbnail-image'      )[i].getAttribute('src').split('_')[0]    );  }  // A polling loop watches the opened popup for Lazada's logo element and  // auto-closes the popup roughly 2-40 seconds later once it detects it.  return images;}
Hosts reached by the affiliate popup
    • adpvn.co

    Receives a window navigation from the content script on your first Download click per session, while the Lazada page is active. A captured Referer confirms this.

CWS listing vs. actual behavior

The Chrome Web Store listing describes this extension only as: "Tự động tải ảnh sản phẩm bất kỳ trên lazada chỉ với 1 click chuột" ("Automatically download any product's images on Lazada with just 1 click"). No affiliate popup or third-party navigation is mentioned in the listing, the permissions prompt, or the extension's own popup UI.

What it can do

Permissions this extension asks for, as declared in version 2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed Tự động tải ảnh trên lazada contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • adpvn.co

    Tự động tải ảnh trên lazada sends data to adpvn.co. No other extension we have analysed sends data here.

Updated 30 September 2026phljgkgnemldknmffnnfigaedibiiobc