Is Widilo - Cashback et Codes Promo safe?

Medium risk

Widilo Cashback embeds a third-party coupon SDK that tracks users with a persistent UUID and sends browsing events to smartshopping.ai.

When a user visits a supported shop checkout page, the extension initializes an embedded smartshopping.ai SDK that reports events including a persistent UUID stored in the browser to stat.smartshopping.ai. The SDK's activation, client ID, and shop configuration decryption key are all controlled remotely via a file hosted on Azure blob storage. Additionally, active tab URLs are included in error reports sent to Widilo's own API whenever an error occurs.

Widilov5.3.1.37882Chrome Web Store
49Risk
Who publishes it

AFILIZA - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Widilo
Declared legal entity
AFILIZA
Registered address
10 RUE DE PENTHIEVRE, PARIS 75008, FR
Registered contact
AFILIZA
Website
www.widilo.fr/mon-profil/service-client

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

Budgey1k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Smartshopping SDK posts checkout events with a persistent UUID

Code shows the remote coupon config can enable the Smartshopping SDK on checkout pages; the extension then posts event JSON to stat.smartshopping.ai with the event name, client ID, and a UUID stored locally and reused.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You browse a shop page while the remote coupon configuration has enabled the Smartshopping SDK.

The SDK start path checks the current tab URL and shop configuration before it sends initialization data to the page.

The extension did this

The extension can post Smartshopping event JSON with a reused browser UUID to stat.smartshopping.ai.

The UUID is generated once and stored under the local extension key smartshopping_uuid.

Captured request
POSThttps://stat.smartshopping.ai/logs?sdkVersion=0.7.0

Static proof identified the exact POST construction; no dynamic request or response body was recorded for this claim.

Headers
Content-Type
application/json;charset=utf-8
Fields posted by the Smartshopping log path
  • Smartshopping event
    {"type":"smartshopping_log"}

    Describes the coupon-engine event that happened while you were using a shop page.

  • Browser UUID
    d7f3a1b2-4c8e-4f21-9a7d-3b2c1d0e9f88 (illustrative)

    Lets Smartshopping link later coupon events back to the same browser profile.

  • SDK client ID
    widilo

    Identifies which extension integration the Smartshopping event belongs to.

  • SDK version
    0.7.0

    Adds software-version context to the event request.

The code that does this

The SDK creates a persistent UUID and posts it with Smartshopping events

Readable version

Persistent UUID helper in deobfuscated/background.js

deobfuscated/background.js
async function g() {  let e = await (0, l.localstoreGet)(["smartshopping_uuid"]);  return p(e) ? e = e.smartshopping_uuid : (e = (0, a.v4)(), await (0, l.localstoreSet)({    smartshopping_uuid: e  })), e}

Smartshopping log handler in deobfuscated/background.js

deobfuscated/background.js
case "smartshopping_log":  const a = await s() || d.DEFAULT_USER_CONFIG;  A({    baseUrls: a.endpoints.stat.base,    endpoint: a.endpoints.stat.logs,    getParams: {      sdkVersion: n    },    options: {      method: "POST",      headers: {        "Content-Type": "application/json;charset=utf-8"      },      body: JSON.stringify({        event: e.event,        userUUID: await g(),        clientID: t      })    }  })
Smartshopping hosts used by this SDK path
    • stat.smartshopping.ai

    Receives Smartshopping log requests at /logs with event JSON, userUUID, clientID, and sdkVersion.

    • api.smartshopping.ai

    Supplies Smartshopping shop URL lists and shop configuration data used before checkout-page events are initialized.

Azure config controls Smartshopping SDK activation and key

Traffic showed the coupon config fetched from elian.blob.core.windows.net/app-extension/caa-config.json (Azure-hosted).

The extension parses it as JSON and, when active, uses the client ID/key to init the SDK and decrypt shop config.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The extension refreshes its coupon auto-application configuration.

This refresh happens before the embedded Smartshopping coupon SDK is installed.

The extension did this

It fetches an Azure-hosted JSON file whose fields decide whether the SDK runs and which key it uses.

If the response is active, the code passes clientID and key directly into the Smartshopping bootstrap function.

Captured request
GEThttps://elian.blob.core.windows.net/app-extension/caa-config.json

Observed during dynamic analysis: response contained clientID=widilo, a key field beginning with PQ3MtG3w, and isActive=false. No request body applies to this GET.

Remote configuration fields used by the coupon SDK path
  • SDK client ID
    widilo

    Tells Smartshopping which extension integration is making later coupon requests.

  • Configuration key
    key field present in the captured response

    Lets the extension read encrypted Smartshopping shop configuration data before it checks a page.

  • Activation flag
    false

    Controls whether the Smartshopping SDK is installed for this extension session.

  • Configuration host
    elian.blob.core.windows.net

    Shows where the extension gets the coupon SDK control file from.

The code that does this

Remote JSON controls SDK bootstrap and shop-config decryption

Readable version

Remote config fetch and bootstrap in deobfuscated/background.js

deobfuscated/background.js
checkServiceConfig() {  return a(this, void 0, void 0, (function*() {    if (!this._isEnabled) return;    const e = yield this.getCouponAutoApplicationConfig();    e ? (null != this.config && this.config.clientID == e.clientID && this.config.key == e.key || (e.isActive ? (this.output = (0, l.bootstrap)({      clientID: e.clientID,      key: e.key    }), yield this.output.install()) : this.output = void 0), this.config = e, this._isActive = e.isActive) : (this._isActive = !1, this.output = void 0, this.config = void 0)  }))}getCouponAutoApplicationConfig() {  const e = this.envService.getRemotelyHostedFilesUrlWithDate(`${n.environment.storageUrl}caa-config.json`),    r = this.errorService;  return fetch(e).then((function(e) {    return a(this, void 0, void 0, (function*() {      return e.ok ? e.json().then((function(e) {        return e      })).catch((function(e) {        return a(this, void 0, void 0, (function*() {          return yield r.logErrorWithoutNotifyingUser(e), null        }))      })) : (yield r.logErrorWithoutNotifyingUser(`${e.status}, ${e.statusText}`), null)    }))  })).catch((function(e) {    return a(this, void 0, void 0, (function*() {      return yield r.logErrorWithoutNotifyingUser(e), null    }))  }))}

Shop config decrypt uses the bootstrap key in deobfuscated/background.js

deobfuscated/background.js
const c = i.default.AES.decrypt(g, o),  x = JSON.parse(c.toString(i.default.enc.Utf8));return x.error ? null : x
Remote hosts involved in the coupon SDK control path
    • elian.blob.core.windows.net

    Hosts caa-config.json, which supplies isActive, clientID, and key values for the coupon SDK path.

    • api.smartshopping.ai

    Serves encrypted Smartshopping shop URL lists and shop configuration data that the SDK decrypts with the configured key.

Where it sends data

Destinations our analysis observed Widilo contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • stat.smartshopping.ai

    Widilo sends data to stat.smartshopping.ai. 2 other extensions we have analysed send data here.

  • api.smartshopping.ai

    Widilo sends data to api.smartshopping.ai. No other extension we have analysed sends data here.

  • browser-extension-api.widilo.fr

    Widilo sends data to browser-extension-api.widilo.fr. No other extension we have analysed sends data here.

  • elian.blob.core.windows.net

    Widilo sends data to elian.blob.core.windows.net. No other extension we have analysed sends data here.

Updated 30 September 2026jlcaefilcommembbekhjjkibeieffchd