Chrome Web StoreDo not install
Code review: critical
Our reviewer read this extension’s code and confirmed malicious behaviour. 3 security findings documented below. Do not install it. Remove it if you already have it.
1 critical finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
AutoBuy Flash Sales, Deals, and Coupons, used by 20,000 people, is rated malicious by Extension Auditor. Our code review reported 3 findings (1 critical, 2 high), led by data exfiltration. Its permissions mean it can read and change data on all websites and allows unsafe code evaluation.
Key findings
- Critical
Data Exfiltration
Every navigation that completes on a host present in the locally cached couponSites map has its complete URL, query string included, POSTed to [domain withheld]. Applying the disclosure cross-check: the destination is neither the publisher website ([domain withheld]), the publisher-level privacy-policy host ([domain withheld]), nor a well-known SaaS a shopping extension would justify; and the data category is history, which is not among the CWS-disclosed categories (Location, User activity). Because the target host list is remotely supplied rather than hard-coded to, the operator controls at runtime which of the user's browsing this covers.
- High
Other
applyDeals() issues a GET to an arbitrary URL returned by the operator's server and never reads the response body — it only returns r.url, the endpoint of the redirect chain. In the data["deals"] branch (line 93) the return value is discarded entirely, so the request has no user-visible effect at all: its only purpose is that the request was made, which is the mechanic behind the affiliate cookie-stuffing IoC recorded for this extension. Combined with <all_urls> host permissions this is an unbounded, remotely directed background request primitive triggered by the user's ordinary browsing.
- High
Unauthorized Data Collection
On every service-worker start the extension fetches its target-host list from the operator, keyed by a persistent 20-character random identifier minted at install time (generateRandomId, line 26;, line 141). This makes the surveillance scope in the finding above fully server-controlled and per-installation targetable — today's list can be Amazon, tomorrow's can be banking or webmail hosts, with no extension update and no user-visible change. The persistent uid is a stable cross-session tracking identifier not covered by the listing's disclosed data-collection categories.
Analyst notes
68-105 sends the full visited URL (including query string) of every completed navigation on a remotely supplied host list to [domain withheld], a domain unrelated to the publisher ([domain withheld]) and not covered by the CWS-disclosed categories (Location, User activity — web history is a separate category); the host list itself is refetched from the same server on every service-worker start (main(), lines 108-131), so the operator can silently retarget any site under the <all_urls> host permission, and applyDeals() (lines 52-64) performs a hidden GET to a server-supplied URL whose response body is discarded — the shape of the cookie-stuffing IoC in the internal notes. Corroborating: permhash cluster flagged malicious, the [domain withheld] News IoC references; contradicting: chrome-stats likelihood and Google's trusted-publisher badge, both of which are signals that say nothing about this code path. The bundled manifest matches the published manifest exactly (MV3,, <all_urls>, content scripts) so there is no mismatch finding; note that (the ~740 KB React bundle that receives the APPLY_COUPONS message and accounts for the counts in the ML evidence) was absent from the bundle and was not reviewed, so no claims are made about it.
AutoBuy Flash Sales, Deals, and Coupons Chrome extension security report
ID: gbnahglfafmhaehbdmjedfhdmimjcbed
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://autobuyapp.com/
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://www.amazon.in/*
- http://www.amazon.in/*
- 1 critical
- 2 high
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 critical finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Now auto buy any type of flash sale products by using our chrome extension
Read the publisher’s full description
In 2025, don’t let flash sales slip through your fingers!! AutoBuy for Amazon Flash Sales is your essential Chrome extension designed to effortlessly secure flash sale products. Perfect for grabbing high-demand items like the Redmi Note 10 Pro, this Flash Sale Auto Buy Extension automates the entire process, ensuring you're among the first to snag popular products. With features like Auto Add to Cart Extension capabilities and options to Resale Flash Sale Products, AutoBuy is your ultimate companion for Buy Limited-Time Deals Quickly on Amazon and other platforms. Key Features Auto-Purchase in Flash Sales: With this Flash Sale Auto Buy Extension, products are automatically added to your cart during high-demand sales, such as the Redmi Note 10 Pro flash sale. Be ready just two minutes before the sales go live. Easy Product Listing for Resale: Secure flash sale deals and seamlessly list them for resale. Create detailed listings with product information to allow interested buyers to connect with you—making it perfect to Resale Flash Sale Products. User Notifications: Stay ahead of the game with timely notifications about upcoming flash sales, ensuring you're prepared to Secure Flash Sale Deals Automatically. One-Click Activation: Forget the hassle of refreshing pages. Simply activate the Auto Add to Cart Extension to register for upcoming sales without constantly monitoring product availability. How to Use AutoBuy for Flash Sales Install the Extension: Add AutoBuy for Amazon Flash Sales to your Chrome browser for easy access. Activate for Sales: Click on the extension icon, navigate to the current Amazon flash sale page, and register by selecting your product. Automatic Cart Addition: Be on the product page two minutes before the sale starts. The extension will Secure Flash Sale Deals Automatically by adding the item to your cart as soon as it becomes available. For Resale: After purchasing, use the "Star" icon in the extension post-12 PM to list your product. Fill in the details, including the product name, email, phone number, and an image. Publish the listing to make it visible to potential buyers looking to Resale Flash Sale Products. FAQs 1. How does AutoBuy work for flash sales? AutoBuy prepares two minutes before a sale starts, refreshing the product page until it’s available and adding it to your cart immediately upon release. 2. Can I use AutoBuy for products other than the Redmi Note 10 Pro? Yes, AutoBuy is compatible with a variety of flash sale items. Just select the product you want on Amazon or other platforms, and let the extension take over. 3. How can I list products for resale? Use the "Star" icon in the extension. Enter product details and contact information, publish the listing, and wait for potential buyers to reach out. 4. Is AutoBuy free to use? Yes, AutoBuy is a free extension for all users looking to streamline flash sale purchases and listings.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 critical finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Shopping
- Honey: Automated Coupons & Rewards14,000,000 users
- Avira Safe Shopping7,000,000 users
- Capital One Shopping: Save Now5,240,703 users
- 中国工商银行密码扩展5,064,867 users
- PayPal Honey: Automated Coupons & Rewards5,001,611 users