Is ZaX - Tiện ích mở rộng cho Zalo safe?
ZaX - Tien ich mo rong cho Zalo exposes a chat.zalo.me page bridge that returns Zalo session keys and can send messages.
On chat.zalo.me, the extension injects a page-accessible bridge that accepts same-window postMessage requests labeled zax_bridge. That bridge can return Zalo session details including encKey, dbKey, uid, client type, and client version, and it can dispatch profile lookup or text-message sending actions through Zalo's private API helpers.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itZaX Lab - no other listings under this identity
ZaX Lab - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 25.5.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on chat.zalo.me
*://chat.zalo.me/*
Read and change your data on zaxapp.org
*://*.zaxapp.org/*
See the address and title of every tab you have open
tabs
Run its own code inside the pages you visit
scripting
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed ZaX - Tiện ích mở rộng cho Zalo contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- chat.zalo.me
ZaX - Tiện ích mở rộng cho Zalo sends data to chat.zalo.me. No other extension we have analyzed sends data here.