IBX-11 — what trusted-store status gives an attacker

Waiting. The extension needs a few seconds.

This page is passive towards the extension: it never calls postMessage, never sends a message to the extension, and never creates, fakes or replaces any extension element. It only (1) reads the extension's own shadowRoot, which is mode:"open", and (2) dispatches clicks on buttons the extension itself placed into this page. Destructive controls ("Untrack all", "Clear all notifications", log out) are blocked by an explicit deny list and are never clicked.

1. Does the extension treat this host as a partner store

Extension root #ibotta-extension-root injectedno
Root has an open shadow root (mode:"open")no
#ibotta-pc price-compare frame — this is the trust signalno
Branded Ibotta bubble ([data-testid=nubbin]) drawn on this siteno
Branded banner / panel visibleno
#tracking frame (unrelated to trust, needs a tracked item)no

2. Victim data this page read out of its own DOM

(nothing yet)

3. Full text of the extension UI living inside this page

(nothing yet)

Log

IBX-11 PROOF PRODUCT - attacker controlled text
9781603580557 · 1603580557
$24.99