Is WealthPipe safe?
WealthPipe sends the full URL of every site you visit or switch to to its own server, with no opt-in.
On every tab navigation and every tab switch, across all websites, WealthPipe's background script reads the active tab's full URL and sends it as a query parameter to wealthpipe.com, continuously streaming a user's browsing history in exchange for a page-rating badge. Separately, the extension's own login password is stored in cleartext in the popup's local storage so it can silently re-authenticate the user on each popup open.
Who publishes itFactPipe - 1 other listing from the same operator, none carrying a finding
FactPipe - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WealthPipe sends every page you visit to its own server on every navigation
Code analysis shows WealthPipe's background worker fetches wealthpipe.com with the full URL of every page you load or switch to, before you ever open its popup.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You load a new page or switch to a different browser tab.
This works the same way on every website, there is no list of supported sites.
The extension immediately sends that page's full URL to wealthpipe.com.
The request fires whether or not you ever open the extension's popup.
- Full page URLhttps://www.example-bank.com/accounts/summary?id=48213
The complete address of the page you just loaded or switched to, including any query string.
- Browsing pattern over time12 requests in 3 minutes across 5 different domains
Because the request repeats on every navigation and tab switch, the server can reconstruct your browsing session across sites.
The listeners and the request they trigger
Plain-English equivalent
on_any_tab_navigate_or_switch(() => { const currentPageUrl = getActiveTab().url; fetch('https://wealthpipe.com/api/article-rating?url=' + currentPageUrl);});- wealthpipe.com
The extension vendor's own backend. Receives the full URL of every page you visit or switch to, on every website, via the /api/article-rating endpoint.
Confirms the extension requests wealthpipe.com with the active tab's URL on every navigation, without opening the popup.
- Chrome or a Chromium-based browser
- Developer mode enabled in chrome://extensions
// Run in the extension's service worker console (chrome://extensions -> WealthPipe -> service worker)const origFetch = self.fetch;self.fetch = function (...args) { console.log('[wealthpipe-repro] fetch ->', args[0]); return origFetch.apply(this, args);};// Now switch tabs or navigate in the browser and watch the console:// each navigation/tab-switch logs a fetch to wealthpipe.com/api/article-rating?url=<current tab url>// with the popup never opened.- 1Load the extension.
- 2Open chrome://extensions, click 'service worker' under WealthPipe.
- 3Paste this script.
- 4Switch tabs or navigate.
- 5Watch fetch logs to wealthpipe.com.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed WealthPipe contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- wealthpipe.com
WealthPipe sends data to wealthpipe.com. No other extension we have analyzed sends data here.