Avast and AVG products removed from the Firefox add-ons directory due to sending personal data

Mozilla removed from the catalog addons.mozilla.org (AMO) four extensions from Avast - Avast Online Security, AVG Online Security, Avast SafePrice, and AVG SafePrice. The extensions have been removed due to the organization leaking users' personal data. Google has not yet responded to the incident regarding the extensions. remain in the directory Chrome App Store.

In the code of the extensions three vulnerabilities have been identified there were injections to upload user profiles and detailed page view history to the site uib.ff.avast.com. Significantly more data was transmitted externally than necessary for the declared functionality of the extensions for security checks (alerting about malicious sites) and providing assistance with online purchases (price comparison, providing coupons, etc.).

For instance, data was sent about the URLs opened (with query parameters), the operating system, user ID, locale, the method of arriving at the page, referer, etc. Interestingly, it is clearly stated on the website of the Avast-owned company Jumpshot that they sell users' activity data, which is suitable for analyzing their preferences when searching for and choosing certain products. Mozilla has removed from the catalog

Source: opennet.ru