Is Revyu.AI - Your Ultimate Travel Assistant safe?
We analyzed Revyu.AI - Your Ultimate Travel Assistant version 1.1.0's actual code and gave it a 68/100 trust score. This is a purpose-aligned travel…
Bottom line
This is a purpose-aligned travel assistant with broad site access and persistent activity-linked data sharing, but no clear evidence of malicious abuse.
What it can access
It can automatically read and modify pages across many hotel-booking sites and send hotel details plus its own form data to its service, broadly matching its travel purpose but creating privacy exposure. [Q1][Q2][Q6][Q15]
Security weaknesses
Its automatic operation across many booking sites and broad page scope increase the consequences of a compromised or misused extension, though no exposed privileged bridge was found. [Q1][Q8][Q21]
Signs of misuse
It sends viewed hotel activity and user-entered travel details to its service with a persistent device ID, raising tracking concerns, but the collection is tied to the advertised feature. [Q6][Q12][Q13][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has persistent content-script and host access across major hotel-booking services, plus tabs, activeTab, and storage permissions. This lets it run automatically and read or change pages within that broad travel-site scope.
Declares tabs, activeTab, storage, extensive hotel-site host permissions, two automatic content scripts, and broad web-accessible resources. — manifest.json:16-262
Which websites can it run on, and can it read or change what appears on those pages?
It changes supported pages by adding fixed sidebar and full-page search roots, styles, font links, and packaged module scripts. The visible changes are extension-owned UI rather than rewrites of the site's existing content.
Appends style/font links, a sidebar root, main.js, and extension CSS. — assets/contentScript.js:1-11
Appends a fixed search root, searchApp.js, and extension CSS. — assets/searchScript.js:1-24
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads hotel identifiers, page titles, address metadata, and—only as a fallback—searches the page HTML for location fields. No code was found selecting passwords, payment fields, messages, or booking-form values.
Extracts hotel_id from a hidden input or URL and derives hotel name/city/country from the title, metadata, or address strings in page HTML. — assets/main.js:1105-1108
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the current supported page's URL to identify a hotel, and the popup reads the active tab URL to show whether the site is supported. It does not request browser history or enumerate past visits.
Parses window.location.href/pathname for Booking and Expedia hotel identifiers. — assets/main.js:1105-1108
Queries the active tab and checks its URL hostname against a fixed supported-site list. — assets/PopupComponent.js:1-59
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Permissions are limited to activeTab, tabs, and storage. — manifest.json:16-20
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends hotel IDs or hotel names and locations, user questions, and submitted travel-search details to services.revyu.io. Every request includes a persistent device ID and may include a server-issued session ID.
Creates device/session IDs, attaches X-Device-ID/X-Session-ID, and defines hotel, insight, and recommendation API requests. — assets/index.js:1-2
Builds and submits destination, traveler count, child ages, dates, and free-text requirements as a recommendation query. — assets/index.js:504-590
Sends user hotel questions to the remote insights endpoint. — assets/main.js:824-824
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Parses API responses as data for React state and rendering; no response reaches a code-execution primitive. — assets/index.js:1-590
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Both page access run automatically on matched travel pages. Hotel detail pages automatically identify the hotel and call Revyu's services; searches and custom questions require user submission.
Registers automatic document_idle scripts across the supported sites. — manifest.json:78-223
On load, derives the hotel and invokes the data-fetching hook. — assets/main.js:1105-1108
The hook automatically calls the reviews or hotels-by-name API. — assets/index.js:1-2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings, proxy, search-provider, or override capabilities are declared. — manifest.json:1-273
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Minified React application retains readable API URLs, storage keys, field names, and logic. — assets/index.js:1-590
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Targeted review of all JavaScript files found no executable text-to-code primitive. — inventory.json:1-end
Does it track the websites, pages, searches, or links you visit?
It does not collect general browser history, but it automatically reports which supported hotel is being viewed. Because the request carries a persistent device ID, hotel-view activity can be linked over time.
Automatically derives the current hotel from each supported hotel page. — assets/main.js:1105-1108
Looks up that hotel remotely and attaches the stable revyu_device_id to every request. — assets/index.js:1-2
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and stores a persistent random device identifier and accepts a server-issued session identifier, attaching them to services requests. No advertising or third-party analytics SDK was found.
Uses crypto.randomUUID for revyu_device_id, stores revyu_session_id, and sends them as X-Device-ID and X-Session-ID. — assets/index.js:1-2
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or webRequest permission; source review found no credential or cookie access. — manifest.json:16-20
Does it record typing, form entries, clipboard contents, or screenshots?
It transmits text and travel details entered into its own UI after submission, including hotel questions, destination, dates, party size, and child ages. It does not log keystrokes or read text from the host site's forms.
Collects extension-form values and submits the assembled query only on form submit. — assets/index.js:504-590
Sends a user-submitted hotel question to the insights endpoint. — assets/main.js:824-824
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote calls fetch fixed hotel-analysis endpoints and render returned data; response fields are not dispatched as commands. — assets/index.js:1-590
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It displays server-selected hotel recommendations, images, explanations, prices, and booking links inside an overlay. The package does not disclose whether the links are affiliate links, so commercial attribution cannot be confirmed.
Renders recommendation response fields and a server-supplied bookingUrl as a Book Now link. — assets/index.js:504-590
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or request-blocking rules are declared. — manifest.json:1-273
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Permissions and host access contain no file, localhost, nativeMessaging, or local-network targets. — manifest.json:16-76
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Injects only chrome.runtime.getURL('assets/main.js'). — assets/contentScript.js:1-11
Injects only chrome.runtime.getURL('assets/searchApp.js'). — assets/searchScript.js:1-24
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Falls back to page localStorage when chrome.storage is unavailable and exposes no privileged page bridge. — assets/index.js:1-2
Handles internal openTab messages only; the manifest declares no externally_connectable access. — assets/background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Site-specific parsing selects the appropriate hotel identifier; the resulting workflow is the same visible review tool. — assets/main.js:1105-1108
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Rate limits API calls, uses bounded retries, and loads a packaged city dataset for autocomplete. — assets/index.js:1-590
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
All edited/submitted fields are React controls in the extension-created search overlay. — assets/index.js:504-590
No host-form mutation or action rewrite was found. — assets/main.js:1-1108