Is Twitter Enhanced safe?

Medium risk

Twitter Enhanced sends saved Twitter/X remarks and usernames to Google Analytics when remarks are used or updated.

When you add, edit, or save a remark, the content script logs analytics events containing the Twitter/X username and remark text. Saving remarks also sends the current saved remarks list, including usernames and remark values, to Google Analytics collection.

Old Autumnv1.2.5Chrome Web Store
47Risk
Who publishes it

Old Autumn - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Old Autumn
Website
github.com/penkzhou/twitter-enhanced

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Twitter/X remarks are sent to Google Analytics event collection.

Adding, editing, or saving Twitter/X remarks in Twitter Enhanced sends the remark text and saved remarks list to Google Analytics at www.google-analytics.com/mp/collect, including form input tied to the extension's analytics parameters.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user adds, edits, or saves a Twitter/X remark.

The extension did this

The extension sends the username, remark text, and saved remarks list in Google Analytics event parameters.

Captured request
POSTwww.google-analytics.com/mp/collect
Fields in the request
  • Your remark text
    example remark text (illustrative)

    User-entered note content can reveal what you recorded about a Twitter/X account.

  • Your saved remarks list
    [{"username":"example_user","remark":"example note"}] (illustrative)

    Stored remarks can expose a history of saved notes and associated Twitter/X usernames.

Observation

Dynamic analysis confirmed that the analytics path sends remark-related parameters to Google Analytics when remark actions are used.

What it can do

Permissions this extension asks for, as declared in version 1.2.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on twitter.com

    *://twitter.com/*

  • Read and change your data on mobile.twitter.com

    *://mobile.twitter.com/*

  • Read and change your data on api.twitter.com

    *://api.twitter.com/*

  • Read and change your data on tweetdeck.twitter.com

    *://tweetdeck.twitter.com/*

  • Read and change your data on x.com

    *://x.com/* and 1 more

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed Twitter Enhanced contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Twitter Enhanced sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026cdcjmkiabmominbckhhcbjleidhddjfc