What our analysis found

BestPrice Assistant, used by 30,000 people, is rated caution by Extension Auditor. Our code review reported 5 findings (3 critical, 1 high, 1 medium), led by unauthorized data collection. Its permissions mean it can read and change data on all websites.

Key findings

• critical· unauthorized data collection —On extension install, the code collects platform fingerprint data (OS, architecture, platform string) along with a hardcoded adware-network extensionId (`3e60073c-64d7-4697-955f-50f8a707b22e`, distinct from the CWS extension ID) and POSTs it base64-encoded to ` This domain is entirely unrelated to the extension's currency-conversion purpose, is not disclosed in the CWS privacy policy (which points to ` `), and the payload is intentionally obfuscated (base64 via `window.btoa`) to avoid casual inspection.
• critical· tracking —On every tab update (or on a configurable periodic interval), the code sends the current tab's URL and page title, together with a persistent user ID, base64-encoded to ` This constitutes covert collection of full browsing history by an undisclosed third party— is not the publisher's domain (` `) and browsing history is not listed under the extension's CWS-disclosed data-collection categories (only 'Website content').
• critical· remote code loading —After fetching a campaign array (`cmps`) from the server, the extension creates new browser windows, new tabs, or silently redirects the active tab to arbitrary server-controlled URLs. This gives the remote server full control to redirect users to any destination (phishing, ad fraud, malware distribution) without user consent or any disclosure in the extension's CWS listing.
• high· other —The bundled manifest is Manifest V2 with `unsafe-eval` permitted in its CSP and names the extension 'Chrome Currency Converter', while the live CWS listing reports Manifest V3 with `contextMenus`/`storage` permissions and name 'BestPrice Assistant'. This material discrepancy between the installed extension and the published listing means users and the Chrome Web Store review process are evaluating a different artifact than what is executing on their machines.
• medium· tracking —The adware registers an uninstall URL pointing to (not the publisher's own domain), which would override any uninstall tracking the legitimate developer set and allows the adware network to record user removals and potentially prompt reinstall pages.

The extension bundle contains ` `, a fully self-contained webpack bundle that sends browsing history (tab URL + title, base64-encoded) to the unrelated third party ` registers users at ` ` using a hardcoded adware network extensionId (`3e60073c-64d7-4697-955f-50f8a707b22e`), and then executes server-controlled creation or redirects based on campaign instructions returned by the server. Although in this version the file is not referenced by any manifest-declared script, it is present in `web_accessible_resources` (`assets/*`), the bundled manifest (MV2 with `unsafe-eval`) materially mismatches the published CWS manifest (MV3), the publisher's only other extension is flagged malicious, and the adware infrastructure is complete and operational—strongly indicating this is either a vestigial active payload from a recent version or will be re-activated in a subsequent update. Third-party chrome-stats corroborates elevated impact; the ML score is low, consistent with the code being largely hidden in the assets directory rather than the declared JS files.