Is unFunnelizer safe?
unFunnelizer sends video download and conversion page URLs to Google Analytics and its backend.
When you convert or download videos, unFunnelizer reports the source page URL with a persistent extension client or install ID. Its background worker also watches requests across tabs to record marketing pixel IDs and matching video stream URLs for use inside the extension.
Who publishes itRhea Victor - 1 other listing from the same operator, none carrying a finding
Rhea Victor - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 1k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Background worker logs ad-tracking pixel IDs from every site you visit
Even on sites unrelated to Facebook Ads Library, the extension's background worker watches network requests to Meta, Google, TikTok, Taboola and Utmify trackers and records each pixel ID it sees, tied to the tab.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You visit any website, not just Facebook Ads Library, that loads a Meta, Google, TikTok, Taboola or Utmify tracking pixel.
The extension's background worker reads the pixel request and stores the tracker's ID and name for that tab.
The pixel listener is registered for every tab, not scoped to Facebook
function registerPixelListener() { chrome.webRequest.onBeforeRequest.addListener(request => { (async () => { const url = request.url, tabId = request.tabId; if (tabId < 0) return; await ensurePixelCacheLoaded(); for (const tracker of TRACKER_PATTERNS) { if (!url.includes(tracker.pattern)) continue; // ... extract id from URL query param or, for Utmify, from requestBody JSON ... if (alreadySeen(tabId, tracker.id, id)) return; recordPixel(tabId, tracker.id, id, tracker.name); chrome.runtime.sendMessage({ type: 'PIXEL_FOUND', payload: { type: tracker.id, name: tracker.name, id, timestamp: Date.now() } }).catch(() => {}); break; } })(); }, { urls: [ '*://*.facebook.com/tr*', '*://*.google-analytics.com/*', '*://*.googletagmanager.com/*', '*://*.googleadservices.com/*', '*://*.doubleclick.net/*', '*://*.analytics.tiktok.com/*', '*://*.trc.taboola.com/*', '*://*.tracking.utmify.com.br/*' ] }, ['requestBody']);}A planted marker value was transmitted from a non-Facebook test page and confirmed present afterward in the extension's local pixel-detection store, showing the listener runs on ordinary browsing tabs.
Per tab, which ad networks fired and their pixel IDs. This ID is the planted marker observed here; the tab key/timestamp are illustrative.
- Location
- chrome.storage.session key 'detectedPixelsByTab'
{ "<tabId> (illustrative)": [ { "id": "G-CANARY99887", "name": "Google Analytics 4", "type": "ga", "timestamp": "<capture time> (illustrative)" } ]}- facebook.com
Meta Pixel ad-conversion tracking
- google-analytics.com
Google Analytics 4 and Universal Analytics
- googletagmanager.com
Google Tag Manager and Google Ads tag loading
- googleadservices.com
Google Ads conversion tracking
- doubleclick.net
Google Ads view-through conversion tracking
- analytics.tiktok.com
TikTok Pixel tracking
- trc.taboola.com
Taboola native-ad tracking
- tracking.utmify.com.br
Utmify affiliate/lead attribution tracking
Background worker logs video stream URLs and page details from every tab
On any website, not just Facebook Ads Library, the background worker watches for VTurb, Vidalytics and Wistia video requests and records the stream URL plus the page's URL, title and favicon.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You visit any website, not just Facebook Ads Library, that loads a VTurb, Vidalytics or Wistia video stream.
The background worker records the stream URL together with that tab's page URL, title and favicon.
The video listener runs on any tab, not scoped to Facebook
function registerVideoListener() { chrome.webRequest.onBeforeRequest.addListener(request => { const url = request.url; for (const provider of VIDEO_PROVIDER_PATTERNS) { if (!provider.pattern.test(url)) continue; const tabId = request.tabId; if (tabId >= 0) { chrome.tabs.get(tabId, tab => { const record = { url, platform: provider.name, timestamp: Date.now(), tabId, pageUrl: tab?.url || '', pageTitle: tab?.title || '', pageFavicon: tab?.favIconUrl || '' }; videoCaptures.push(record); chrome.runtime.sendMessage({ type: 'VIDEO_CAPTURED', payload: record }).catch(() => {}); }); } break; } }, { urls: ['*://*.converteai.net/*', '*://*.vturb.net/*', '*://*.vidalytics.com/*', '*://*.wistia.com/*'] });}A planted marker stream URL was requested from a non-video, non-Facebook test page. The extension's internal VIDEO_CAPTURED broadcast carried that URL plus the test page's URL and title.
- Video stream URLhttps://fast.wistia.com/embed/medias/abc123def.m3u8
The direct link to the video segment playlist that was loading.
- Page you were onhttps://example.com/
The address of the tab the video was playing in.
- Page titleExample Domain
The browser tab's title text at capture time.
- Page faviconhttps://example.com/favicon.ico
The small site icon shown in the tab, fetched from the page.
- converteai.net
VTurb video-hosting CDN, used by sales-funnel video pages
- vturb.net
VTurb video-hosting CDN
- vidalytics.com
Vidalytics video-hosting platform
- wistia.com
Wistia video-hosting platform
Where it sends data
Destinations our analysis observed unFunnelizer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
unFunnelizer sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- back-ends-unfunnelizer-backend.3271cy.easypanel.host
unFunnelizer sends data to back-ends-unfunnelizer-backend.3271cy.easypanel.host. No other extension we have analysed sends data here.