PayPal Honey: Automated Coupons & Rewards

Version 19.3.0 View in Chrome Web Store

Last scanned: 9 days ago | force re-scan

Extension Details

Developer: https://www.joinhoney.com/

Rating: 4.6 ★ (179.8K ratings)

Users: 13,000,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: PayPal Honey is a legitimate extension from a reputable company (PayPal/Honey Science Corporation) with an impressive 13 million users and strong 4.6-star rating from nearly 180,000 reviews. The extension's core functionality of finding and applying coupon codes requires access to e-commerce websites, which explains many of its permissions. Being owned by PayPal adds significant credibility to the extension's trustworthiness.

Concerns: The extension requests several powerful permissions that could be concerning in the wrong hands. The cookies permission allows reading and modifying browser cookies across all websites, which could expose session data. The webRequest permission enables intercepting and potentially modifying web traffic. The broad host permissions (all HTTP/HTTPS sites) mean the extension can access every website you visit. While these permissions align with Honey's coupon-finding functionality, they create a large attack surface if the extension were compromised.

Recommendations: Given the extension's legitimate purpose and strong reputation, the risk is manageable for most users. However, privacy-conscious users should be aware that Honey collects browsing data for its business model. Consider reviewing Honey's privacy policy to understand data collection practices. If you're particularly security-focused, you could run this extension in a separate Chrome profile used only for shopping, limiting its access to sensitive browsing activities like banking or work-related sites.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

alarms
cookies
storage
unlimitedStorage
scripting
webRequest
offscreen

Host Permissions:

http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self';
isolated_world: script-src 'self'; object-src 'self';

Embedded URLs (335 total):

https://www.joinhoney.com/es/privacy	http://paypal.com/payin4
https://www.joinhoney.com/es/terms	https://www.joinhoney.com/es/terms#honey-gold
https://www.paypal.com/us/webapps/mpp/ua/pp-rewards-program-tnc	https://www.joinhoney.com/fr/privacy
https://www.joinhoney.com/fr/terms	https://www.joinhoney.com/fr/terms#honey-gold
https://www.joinhoney.com/it/privacy	https://www.joinhoney.com/it/terms
https://www.joinhoney.com/it/terms#honey-gold	https://www.joinhoney.com/nl/privacy
https://www.joinhoney.com/nl/terms	https://www.joinhoney.com/nl/terms#honey-gold
https://www.joinhoney.com/de/privacy	https://www.joinhoney.com/de/terms
https://www.joinhoney.com/de/terms#honey-gold	https://www.joinhoney.com/en/privacy
https://www.joinhoney.com/pt/privacy	https://www.joinhoney.com/pt/terms
https://www.joinhoney.com/pt/terms#honey-gold	https://www.joinhoney.com/privacy
https://www.joinhoney.com/terms	https://www.joinhoney.com/terms#honey-gold
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://www.4wheelparts.com/cart/shoppingCart.jsp?_DARGS=/cart/includes/shoppingCartEnd.jsp
https://www.ae.com/ugp-api/bag/v1/coupon	https://www.aeropostale.com/on/demandware.store/Sites-aeropostale-Site/en_US/Cart-AddCouponJson
https://www.aeropostale.com/on/demandware.store/Sites-aeropostale-Site/en_US/COBilling-UpdateSummary	https://www.amazon.com/gp/buy/spc/handlers/add-giftcard-promotion.html/ref=ox_pay_page_gc_add
https://secure-athleta.gap.com/shopping-bag-xapi/apply-bag-promo/	https://secure-bananarepublic.gap.com/shopping-bag-xapi/apply-bag-promo/
https://www.bathandbodyworks.com	https://www.belk.com/on/demandware.store/Sites-Belk-Site/default/Coupon-Validate
https://www.buyagift.co.uk/Basket/ApplyDiscount?code=	https://www.carid.com/cart.php
https://www.carid.com/cart.php?mode=unset_coupons	https://www.catherines.com/on/demandware.store/Sites-oss-Site/default/Cart-SubmitForm
https://shop.coles.com.au	https://www.cvs.com/RETAGPV3/RxExpress/V2/applyCoupon
https://www.dsw.com	https://cdn.joinhoney.com/dummy-store/api/
https://www.expedia.com/Checkout	https://www.fitflop.com/us/en/cart/coupon
https://www.forever21.com	https://secure-www.gap.com/shopping-bag-xapi/apply-bag-promo/
https://www2.hm.com/en_ca/checkout/redeemVoucher	https://www2.hm.com/en_ca/checkout/releaseVoucher
https://www.hammacher.com/shoppingcart/applypromocode	https://www.homedepot.com
https://order-api.jcpenney.com/order-api/v1/accounts/	https://www.jcrew.com/checkout-api/graphql
https://www.kohls.com/cnc/applyCoupons	https://www.loft.com/cws/cart/claimCoupon.jsp
https://www.loft.com/cws/cart/removeCoupon.jsp	https://www.macys.com/my-bag/
https://www.officedepot.com	https://secure-oldnavy.gap.com/shopping-bag-xapi/apply-bag-promo/
https://www.orbitz.com/Checkout/applyCoupon	https://www.orbitz.com/Checkout/removeCoupon
https://www.papajohns.com/order/validate-promo?promo-code=	https://www.papajohns.com/order/apply-promo/
https://www.papajohns.com/order/view-cart	https://www.prettylittlething.fr/pltmobile/coupon/couponPost/
https://checkout.prettylittlething.fr/checkout-api/coupon/set	https://checkout.prettylittlething.fr/checkout-api/coupon
https://www.prettylittlething.com/pltmobile/coupon/couponPost/	https://checkout.prettylittlething.com/checkout-api/coupon/set
https://checkout.prettylittlething.com/checkout-api/coupon	https://www.puritan.com/shoppingcart/applyCoupon
https://www.saksfifthavenue.com/cart-coupon-add	https://www.sephora.com/api/shopping-cart/basket/promotions
https://www.sephora.com/api/shopping-cart/baskets/current/promotions	https://www.shutterstock.com/papi/orders/
https://www.staples.com/cc/api/checkout/default/coupon?responseType=WHOLE&mmx=true&buyNow=true&dp=Coupon	https://tjmaxx.tjx.com/store/checkout/cart.jsp?_DARGS=/store/checkout/views/cart.jsp.promo
https://www.vitacost.com/Checkout/ShoppingCart.aspx?sce=view	https://www.wish.com/api/promo-code/apply
https://www.worldmarket.com/on/demandware.store/Sites-World_Market-Site/en_US/Cart-ApplyCoupon	https://www.worldmarket.com/on/demandware.store/Sites-World_Market-Site/en_US/Cart-RemoveCouponLineItem

Page 1 of 5

Raw Manifest

{
  "name": "__MSG_Honey_Title__",
  "icons": {
    "16": "icons/honey-logo-16.png",
    "48": "icons/honey-logo-48.png",
    "128": "icons/honey-logo-128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/default-16.png",
      "19": "icons/default-19.png",
      "32": "icons/default-32.png",
      "38": "icons/default-38.png"
    },
    "default_popup": "popover/popover.html",
    "default_title": "PayPal Honey"
  },
  "version": "19.3.0",
  "background": {
    "service_worker": "h0.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_Automatically_find_and_apply_coupon_codes_when_you_shop_online__",
  "permissions": [
    "alarms",
    "cookies",
    "storage",
    "unlimitedStorage",
    "scripting",
    "webRequest",
    "offscreen"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "h1-check.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": false,
      "match_about_blank": false
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "isolated_world": "script-src 'self'; object-src 'self';",
    "extension_pages": "script-src 'self'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "resources": [
        "checkoutPaypal/*",
        "extensionMixinScripts/*",
        "images/*",
        "offscreen/*",
        "paypal/*",
        "proxies/*"
      ]
    }
  ]
}

by ✦ Astarte

PayPal Honey: Automated Coupons & Rewards

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (335 total):

Raw Manifest

Detections

Manifest Findings