Is UAR_SKI_V2P safe?
UAR_SKI_V2P monitors every page you visit and sends the URL to a native application when it detects a marker element.
On every completed page load, on any website, the extension checks the page for a hidden element with the class 'UAR_OrigURL'. If that element is present and contains text, the extension opens a connection to a native helper program installed on the computer (com.skinnovation.uar) and forwards the full URL of the page being visited to it. This happens across all sites with no notice to the user beyond the listing's vague 'URL Auto Redirection' description.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
URL Auto Redirection sends your page URL to a native app on marked pages
Code analysis shows the extension checks every page you visit for an undisclosed marker element.
When present, it sends that page's full URL to a native program named com.skinnovation.uar installed on the device.
You load any website containing an element with the CSS class UAR_OrigURL and non-empty text.
This can happen on any site, not only the naver.com partner domain named in a filter the code never applies.
It reads that marker, then sends the full URL of the page you're on to a native program called com.skinnovation.uar running outside the browser.
No prompt or disclosure accompanies this beyond the store listing text 'URL Auto Redirection'.
A site filter is declared but never wired to the listener that actually runs
var filter = {
url:
[
{hostContains: "naver.com"}
]
}chrome.webNavigation.onCompleted.addListener(SendURL_Complete);
function SendURL_Complete(details){
if (details.url == 'about:blank'){
return;
}
chrome.tabs.sendMessage(details.tabId, "get_contents", function(response) {
if (typeof response !== 'undefined'){
if (response !== "nothing"){
// response = response.replace('OrigURL:','');
// response = response.trim()
// response = encodeURI(response);
// response = response.replace(/\"/g,'%22');
// response = response.replace(/\'/g,'%27');
// console.log(response);
// connect();
// sendNativeMessage(response);
var urlstring = details.url;
//urlstring = urlstring.replace(/\"/g,'%22');
//urlstring = urlstring.replace(/\'/g,'%27');
//urlstring = urlstring.replace(/\#/g,'%23');
console.log(urlstring);
connect();
sendNativeMessage(urlstring);
}
}
});
}chrome.runtime.onMessage.addListener(
function(request, sender, sendResponse) {
//sendResponse({data: document.getElementsByClassName("UAR_OrigURL"), method: "get_contents"}); //same as innerText
var objdom = document.getElementsByClassName("UAR_OrigURL");
if (objdom.length == 0){
sendResponse("nothing");
}
else{
sendResponse(objdom[0].innerText);
}
return true
}
);| Field | Value | Why it matters | |
|---|---|---|---|
Full page URL | https://partner-shop.example/checkout?ref=aff_9284&session=8f2c1a | The exact web address you're on, query parameters included, is sent to the native program whenever the marker element is present. | |
Page marker text | OrigURL:https://original-source.example/article/42 | Read from the page's DOM to decide whether to send the URL. The text itself is not transmitted, it only acts as an on/off switch. |
- com.skinnovation.uar
A native-messaging host installed on the device by the extension's publisher, Skinnovation. Receives the full URL of any marked page outside the browser's network stack.
Injects the marker element the content script looks for, then reloads the page so you can watch the native-messaging call fire.
// Run in the DevTools console of any tab, with the extension installed and enabled. document.body.insertAdjacentHTML( 'beforeend', '<div class="UAR_OrigURL">https://example.com/test</div>' ); location.reload();
- 1Open any site, DevTools Console.
- 2Paste and run this script.
- 3After reload, open the extension's service worker console at chrome://extensions.
- 4Confirm connectNative('com.skinnovation.uar') runs and the URL is logged.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.