Is Zid Sway3 (B1-B2) safe?

Medium risk

Zid Sway3 replays Rosetta Stone API requests with modified progress and lesson-completion values.

Zid Sway3 watches Rosetta Stone API traffic and stores matching request headers and bodies in session storage. Its popup uses those captured requests to send modified time, score, and lesson-progress updates back to Rosetta Stone endpoints.

WizyToolv1.5.0Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup replays Rosetta Stone progress requests with modified completion values

The popup can reuse Rosetta Stone API requests cached from your session: stored headers, URLs, and session data are sent as modified progress/lesson-completion requests to tracking.rosettastone.com and gaia-server.rosettastone.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

User starts a progress or lesson-completion action in the extension popup.

The extension did this

The extension reuses cached Rosetta Stone API requests and sends modified progress and completion values.

Captured request
POSTtracking.rosettastone.com/*; gaia-server.rosettastone.com/graphql
Fields in the request
  • Request headers
    authorization: Bearer ... (illustrative)

    Headers can carry session context needed to replay the Rosetta Stone API request.

  • Rosetta Stone request URL
    https://tracking.rosettastone.com/path_step_scores (illustrative)

    The URL identifies which Rosetta Stone progress or lesson endpoint is being reused.

  • Cached session request data
    durationMs: 600000 (illustrative)

    Stored request data provides the original progress payload that the extension changes before sending.

Observation

Dynamic analysis confirmed that the extension stores matching Rosetta Stone progress requests and uses popup actions to call the replay paths.

What it can do

Permissions this extension asks for, as declared in version 1.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on totale.rosettastone.com

    *://totale.rosettastone.com/

  • Read and change your data on tracking.rosettastone.com

    *://tracking.rosettastone.com/

  • Read and change your data on learn.rosettastone.com

    *://learn.rosettastone.com/

  • Read and change your data on gaia-server.rosettastone.com

    *://gaia-server.rosettastone.com/

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

  • Watch, block and rewrite every request your browser makes

    webRequestBlocking

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Zid Sway3 (B1-B2) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • gaia-server.rosettastone.com

    Zid Sway3 (B1-B2) sends data to gaia-server.rosettastone.com. No other extension we have analysed sends data here.

  • tracking.rosettastone.com

    Zid Sway3 (B1-B2) sends data to tracking.rosettastone.com. No other extension we have analysed sends data here.

Updated 30 September 2026nllfpdicjmdlcjdaagmcbidfmjiccnin