Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: YouGov Pulse

CRITICAL RISK

YouGov Pulse

ID: ihfgglejeolnlbolpjmnhfpfkefjoeec

Extension Info & Metadata

Status

Active

Version

3.0.1

Size

0.02 MB

Rating

2.0/5

Reviews

295

Users

10,000

Type

Extension

Updated

Feb 13, 2024

Publisher Contextual Analysis

Author: realityminehelpView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

26,806

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

The YouGov Pulse browser extension accompanies the YouGov Pulse application for the opt-in market research programme to allow…

The YouGov Pulse browser extension accompanies the YouGov Pulse application for the opt-in market research programme to allow measurement of browser usage.

User Growth

Showing data from Mar 18, 2024 to Mar 18, 2025

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 291 ratings

Average Rating

Current: 1.97 / 5.0-0.03

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.1 Code review	7

Extension Version	Code Review Findings
3.0.1	7

Files with findings

3 distinct paths — top paths by unique finding count:

background.js4
api/client_interface.js2
ContentScripts/domInject.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.js (line 272)	The extension captures raw request bodies (decoded from binary) for URLs matching a server-side configurable filter list (`url_filters.request_body`). This list is fetched remotely from the companion desktop app, mean…	3.0.1
2	Data Exfiltration	critical	background.js (line 360)	On every completed request across all URLs, the extension builds a DGP record (including URL, headers, cookies, and conditionally request/response bodies) and queues it for transmission to the companion desktop applic…	3.0.1
3	Data Exfiltration	critical	api/client_interface.js (line 126)	All captured browsing data (URLs, cookies, headers, request/response bodies) is exfiltrated to a companion desktop application via two channels: native messaging (port name `com.realitymine.yougovpulse`) or HTTP POST …	3.0.1
4	Unauthorized Data Collection	critical	background.js (line 444)	For every HTTP/HTTPS request across all URLs, the extension assembles a full DGP record containing the URL, method, timestamp, user agent, referer, full cookie header, set-cookie response header, request body, and res…	3.0.1
5	Network Interception	high	background.js (line 548)	The extension registers `webRequest` listeners with `extraHeaders` on all URLs, which grants access to headers that Chrome normally hides from extensions (e.g., Authorization, Cookie headers stripped by CORB). Combine…	3.0.1
6	Remote Code Loading	high	api/client_interface.js (line 201)	The extension fetches its full configuration (including URL filter lists controlling what request/response bodies are captured) from a companion desktop application over localhost. This configuration is refreshed ever…	3.0.1
7	Tracking	high	ContentScripts/domInject.js (line 13)	A content script injected into every page across all URLs adds hidden DOM input fields with a persistent panel user ID (`DotmetricsPanelUserId`) and household ID (`DotmetricsPanelHouseholdId`). These fields expose the…	3.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


stackoverflow.com	/questions/105034/how-to-create-guid-uuid	https://stackoverflow.com/questions/105034/how-to-create-guid-uuid
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Owes me about 30,000 points and won't budge. I will be reporting you to the better business bureau immediately, so please get back to me with a solution beforehand.

Edward Thomas·29 Jul 2025

not working

Murhaph·24 Apr 2025

I installed it it doesn't work It never refuse anything I have an uninstalled it and reinstalled it and it still doesn't work

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

YouGov Pulse

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating