Is Viral Vue for Amazon Influencers & Associates safe?

Medium risk

Viral Vue sends supported-site page URLs to api-iris.viralvue.com during session checks.

When Viral Vue runs on supported pages, its session validation request includes the current page URL as an x-referer header. That sends the visited supported-site URL or referrer to ViralVue's API during startup and navigation checks.

Viral Vuev1.28.2Chrome Web Store
45Risk
Who publishes it

Viral Vue LLC - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Viral Vue
Declared legal entity
Viral Vue LLC
Registered address
14852 S Heritagecrest Way, Unit D, Riverton, UT 84065, US
Registered contact
Viral Vue

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

associates.amazon.ca
Also called by 3 other listings, including Logie 5 for Amazon Influencers
affiliate-program.amazon.co.uk
Also called by 4 other listings, including Logie 5 for Amazon Influencers

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Current Page URL Sent to ViralVue on Page Load

Viral Vue checks session validity on every supported page load, Amazon, YouTube Studio, Canva, Pinterest, before you touch it, sending the page URL to ViralVue's servers in a header.

A planted marker URL reached api-iris.viralvue.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a supported page, like an Amazon listing or your YouTube Studio dashboard.

No click on the extension icon or any extension UI is required.

The extension did this

The extension automatically sends the page's URL to ViralVue's servers as part of a session-validation check.

The URL travels in a request header, not the request body.

The code that does this

Page URL captured by the content script, attached by the shared fetch helper

Readable version

Content-script wrapper, renamed for readability

async function callBackgroundApi(request) {  const { endpoint, options = {}, priority = "low", regionOverride } = request;  try {    // Capture the URL of the page the content script is running on.    const currentPageUrl = new URL(window.location.href);    await ensureReady();    const result = await fetchManager.handleFetchRequest(      {        endpoint,        options,        priority,        regionOverride,        noRedirect: request.noRedirect || false,      },      currentPageUrl // passed through so it can be attached to the outgoing request    );    if (!result.ok) throw result.error;    return result;  } catch (err) {    return { ok: false, error: normalizeError(err) };  }}

FetchManager method, renamed for readability

async handleFetchRequest(request, currentPageUrl) {  try {    if (!this.ready) {      this.logger.info("FetchManager not ready, loading token...");      this.loadAccessToken();    }    this.updateRegion(currentPageUrl);    let url = request.endpoint;    const isRelative = url.startsWith("/");    const noRedirect = request.noRedirect || false;    // Every relative-endpoint call gets the current page URL attached    // as a request header -- not just the session-validation call.    const fetchOptions = isRelative      ? { ...request.options, headers: { ...request.options.headers, "x-referer": currentPageUrl.href } }      : { ...request.options, headers: { ...request.options.headers } };    if (isRelative) {      const apiUrl = new URL(url, API_BASE);      apiUrl.searchParams.set("region", request.regionOverride ?? this.region);      url = apiUrl.toString();      fetchOptions.headers = { ...fetchOptions.headers, "X-Access-Token": this.accessToken || "none" };      fetchOptions.credentials = "include";    }    if (request.compression === "gzip") {      fetchOptions.headers["Content-Encoding"] = "gzip";      fetchOptions.body = gzip(fetchOptions.body);    }    fetchOptions.redirect = noRedirect ? "manual" : "follow";    return await this.enqueue(url, fetchOptions, isRelative, request.priority);  } catch (err) {    this.logger.warn("Error handling", request.endpoint, request.options.method || "GET", ":", err);    return { ok: false, error: normalizeError(err) };  }}
Captured request
POSThttps://api-iris.viralvue.com/auth/session?extension_helper=enabled&flagsKey=0e7086320fceaa74eab6691f54a484b036d37aa2a3cdb2b86525bdab3b180210199a94c1119f49262f72aefbf7c79a60398dce62015672bae45e155acd331c6f&userFlagsKey=0e7086320fceaa74eab6691f54a484b036d37aa2a3cdb2b86525bdab3b180210199a94c1119f49262f72aefbf7c79a60398dce62015672bae45e155acd331c6f&region=us

200 OK. We planted a marker value in the active tab's URL and observed it echoed back in this request's x-referer header, confirming the current page URL leaves the device on this call.

Headers
x-referer
https://www.amazon.com/dp/B0EXAMPLE123/ref=cm_sw_r_apin (illustrative — the exact URL of the page open in the active tab)
What the session-validation request discloses
  • Page you're viewing
    https://www.amazon.com/dp/B0EXAMPLE123/ref=cm_sw_r_apin (illustrative)

    The exact web address of the page open in your browser when the automatic session check fires.

  • Feature-flag session key
    0e7086320fceaa74eab6691f54a484b036d37aa2a3cdb2b86525bdab3b18021

    A hashed key tied to your account's feature-flag state, sent alongside the page URL so ViralVue can associate the visit with your session.

Where the page URL is sent
    • api-iris.viralvue.com

    ViralVue's own backend API. Receives your current page URL in the x-referer header on the automatic session-validation call fired whenever a supported page loads.

Where it sends data

Destinations our analysis observed Viral Vue for Amazon Influencers & Associates contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api-iris.viralvue.com

    Viral Vue for Amazon Influencers & Associates sends data to api-iris.viralvue.com. No other extension we have analysed sends data here.

Updated 30 September 2026pakblppeciifkjmkfleeeomhmfiikaej