What our analysis found

Temu image search, used by 3,000 people, is rated caution by Extension Auditor. Our code review reported 5 findings (3 high, 2 medium), led by privilege escalation. Its permissions mean it can inject scripts into pages.

Key findings

• High

  Privilege Escalation

  The extension asks its own backend (K6 = [domain withheld]) for a crawl task, then drives automated Temu catalog requests from the user's browser, attaching the user's logged-in `verifyAuthToken` session cookie and a forged `Anti-Content` anti-bot header, and uploads the harvested goods lists back to [domain withheld] (Eoe at 60050, url q6 = new_rank_save_v2). Ooe (60069) schedules this every 20 seconds for 20 cycles on every [domain withheld] page load. The listing describes only a context-menu reverse-image search; conscripting the user's authenticated Temu session into backend-directed crawling is undisclosed and puts the user's own Temu account at risk of anti-abuse action.

  Show more — Privilege Escalation
• High

  Obfuscation

  The extension ships its own embedded copy of Temu's proprietary 'rose' Anti-Content token generator (webpack module 4051, which assigns `window.rose` at line 2633 inside the extension's isolated world) rather than obtaining the token from the page. Its sole consumers are soe() () at 59691-59734 and the four automated crawl fetches, which set the resulting value as the `Anti-Content` request header. Bundling a lifted anti-bot signer exists only to make programmatic requests indistinguishable from genuine user traffic, which is deliberate evasion of the target site's abuse controls and confirms the crawling is intended to be undetectable.

  Show more — Obfuscation
• High

  Other

  The bundled 1.5.6 manifest does not match the published CWS manifest summary: the published listing declares `storage` in permissions while the bundle does not, and the bundle exposes ` ` as a web-accessible resource to `<all_urls>` while the published summary lists only `img/*` and `icon/*`. host_permissions are identical, and the bundle holds strictly fewer permissions, so this reads as version skew between the analyzed artifact and the live listing rather than a privilege escalation — but it means the interception capability reviewed here is not the capability set described by the store record.

  Show more — Other
• Medium

  Network Interception

  Injected into the MAIN world at document_start on *://*.[domain withheld], this replaces the page's native fetch and XMLHttpRequest with wrappers that clone and read the response bodies of 20 hard-coded Temu API endpoints and relay them via window.postMessage to the content script, which gzips them and ships them to [domain withheld] ( oae at 60511). Silently rewriting a third-party site's network primitives to harvest its authenticated API responses is passive interception the user never initiates and the listing never mentions; the surrounding image-search feature needs none of it.

  Show more — Network Interception
• Medium

  Data Exfiltration

  The service worker exposes an unvalidated relay: any sender may supply an arbitrary `url` suffix and a fully attacker-controlled `config` (method, headers, body) which are passed straight into fetch, with the response handed back to the caller. Because is declared on `<all_urls>` at document_start, this privileged proxy is reachable from every page the user visits, and the only constraint is the [domain withheld] base prefix — no path, method, or payload validation. This is the exfiltration channel used by the interceptor and crawl paths, and a hostile page that can reach the content script inherits it.

  Show more — Data Exfiltration