[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Rakuten: Get Cash Back For Shopping

Version 26.10.0 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Developer: http://rakuten.com/

Rating: 4.9 ★ (43.6K ratings)

Users: 3,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: Rakuten is a well-established, publicly traded e-commerce company with a legitimate cash-back business model. The extension has 3 million users and an excellent 4.9-star rating from over 43,000 reviews, indicating strong user satisfaction and reliability. The company's reputation and business model provide significant credibility.

Concerns: Despite the legitimate business purpose, this extension requires extensive permissions that create substantial privacy and security exposure. The combination of tabs, webNavigation, webRequest, and cookies permissions with broad host access (<all_urls>) means the extension can monitor all your browsing activity, intercept web requests, and access cookies across every website you visit. While necessary for detecting shopping opportunities and applying cash-back offers, these permissions far exceed what most users would expect from a shopping tool and create potential for comprehensive tracking.

Recommendations: Given Rakuten's legitimate business model and strong reputation, the risk is primarily privacy-related rather than malicious. However, users concerned about extensive tracking should consider running this extension in a dedicated Chrome profile used only for shopping activities. Alternatively, manually visit Rakuten's website before making purchases instead of using the extension. For users comfortable with comprehensive browsing tracking in exchange for cash-back rewards, the extension appears safe given the company's established reputation, but be aware that your complete browsing behavior will be monitored.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
webNavigation
webRequest
storage
cookies
alarms
scripting

Optional Permissions:

notifications

Host Permissions:

<all_urls>

Embedded URLs (398 total):

https://github.com/babel/babel/tree/master/packages/babel-runtime	https://github.com/braintree/sanitize-url.git
https://github.com/chakra-ui/chakra-ui.git	https://github.com/chakra-ui/chakra-ui
https://github.com/didomi/react	https://github.com/emotion-js/emotion/tree/main/packages/cache
https://github.com/emotion-js/emotion/tree/main/packages/hash	https://github.com/emotion-js/emotion/tree/main/packages/is-prop-valid
https://github.com/emotion-js/emotion/tree/main/packages/memoize	https://github.com/emotion-js/emotion/tree/main/packages/react
https://github.com/emotion-js/emotion/tree/main/packages/serialize	https://github.com/emotion-js/emotion/tree/main/packages/sheet
https://github.com/emotion-js/emotion/tree/main/packages/styled	https://github.com/emotion-js/emotion/tree/main/packages/unitless
https://github.com/emotion-js/emotion/tree/main/packages/use-insertion-effect-with-fallbacks	https://github.com/emotion-js/emotion/tree/main/packages/utils
https://github.com/emotion-js/emotion/tree/main/packages/weak-memoize	https://github.com/swc-project/swc.git
http://www.apache.org/licenses/	http://www.apache.org/licenses/LICENSE-2.0
https://github.com/TanStack/query.git	https://github.com/xobotyi/scrollbar-width.git
https://github.com/chakra-ui/zag/tree/main/packages/utilities/dom-helpers	https://github.com/chakra-ui/zag/tree/main/packages/utilities/element-size
https://github.com/chakra-ui/zag/tree/main/packages/utilities/focus-visible	https://www.openexchangerates.org
https://github.com/theKashey/aria-hidden.git	https://github.com/axios/axios.git
https://github.com/arthurfiorette/axios-cache-interceptor.git	https://github.com/babel/babel-loader.git
https://github.com/jashkenas/backbone.git	https://github.com/arthurfiorette/tinylibs.git
http://vorb.de	https://github.com/ricokahler/color2k.git
https://github.com/omichelsen/compare-versions.git	https://github.com/sudodoki/copy-to-clipboard
https://github.com/iamkun/dayjs.git	https://github.com/thekashey/detect-node
https://sindresorhus.com	http://jeditoolkit.com
https://github.com/epoberezkin/fast-deep-equal.git	https://github.com/theKashey/focus-lock.git
https://github.com/focus-trap/focus-trap.git	https://github.com/focus-trap/focus-trap-react.git
https://github.com/WICG/focus-visible.git	http://www.w3.org/Consortium/Legal/2015/copyright-software-and-document
https://www.w3.org/community/about/agreements/cla/	https://github.com/framer/motion/
https://github.com/Popmotion/popmotion.git	https://github.com/krisk/Fuse.git
https://github.com/Popmotion/hey-listen.git	https://github.com/remarkablemark/html-dom-parser.git
https://github.com/henrikjoreteg/html-parse-stringify	https://remarkablemark.org
https://github.com/remarkablemark/html-react-parser.git	https://github.com/jamuhl
https://github.com/i18next/i18next.git	https://github.com/immerjs/immer.git
https://github.com/remarkablemark/inline-style-parser.git	https://github.com/jonschlinkert
https://github.com/jquery/jquery.git	https://openjsf.org/
https://github.com/apostrophecms/apostrophe.git	http://underscorejs.org/
https://github.com/lodash/lodash	http://creativecommons.org/publicdomain/zero/1.0/
https://github.com/airbnb/lottie-web.git	http://paul.vorba.ch
https://github.com/motiondivision/motion	https://motion.dev
https://github.com/streamich/nano-css.git	https://unlicense.org
http://github.com/segmentio/obj-case.git	https://github.com/hassansin
https://github.com/hassansin/parse-address.git	https://github.com/albell/parse-srcset.git
https://github.com/Popmotion/popmotion/tree/master/packages/popmotion	https://github.com/facebook/react.git
http://github.com/gaearon	https://github.com/thekashey/react-clientside-effect.git

Page 1 of 5

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "img/icon/icon-32.png",
    "48": "img/icon/icon-64.png",
    "128": "img/icon/icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "img/icon/icon-32.png",
      "32": "img/icon/icon-32.png"
    },
    "default_title": "__MSG_extensionName__"
  },
  "author": "Rakuten",
  "version": "26.10.0",
  "incognito": "split",
  "background": {
    "service_worker": "js/bg.js"
  },
  "options_ui": {
    "page": "settings.html",
    "open_in_tab": true
  },
  "short_name": "Rakuten",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "tabs",
    "webNavigation",
    "webRequest",
    "storage",
    "cookies",
    "alarms",
    "scripting"
  ],
  "homepage_url": "https://www.rakuten.com/",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/libs/snippet.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.rakuten.com/*",
        "https://*.rakuten.co.uk/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "notifications"
  ],
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "workers/*.js",
        "*.css",
        "*.js",
        "fonts/*.woff",
        "fonts/*.woff2",
        "fonts/*.ttf",
        "fonts/*.otf",
        "img/*"
      ]
    }
  ]
}

by ✦ Astarte

Rakuten: Get Cash Back For Shopping

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (398 total):

Raw Manifest

Detections

Manifest Findings