SimilarWeb
| Basic information | |
|---|---|
| Founded | 2007 |
| Legal Structure | Public |
| Industry | Digital market intelligence,Web analytics,Browser extensions |
| Also known as | Similarweb,Similarweb Ltd.,SMWB |
| Official website | https://www.similarweb.com/ |
SimilarWeb (legally Similarweb Ltd.) is an Israeli digital-market-intelligence company that owns two Chrome Web Store extensions independently documented exfiltrating their users' browsing data: Stylish, with roughly 2 million users, & a self-branded SimilarWeb traffic-rank extension with roughly 1 million users.[1][2] The company trades on the New York Stock Exchange under the ticker SMWB after a May 12, 2021 initial public offering.[3] Both extensions were classified as "Confirmed" AI-chat scrapers in security researcher James Arnott's May 11, 2026 audit, which documented chat content from ChatGPT, Claude, & Character.AI leaving users' browsers in network traffic.[1]
Background
[edit | edit source]SimilarWeb was founded in 2007 by Or Offer & is headquartered in Givatayim, Israel. Its core business sells web & app traffic intelligence to brands, investors, & publishers; a portion of the underlying panel data is sourced from a network of browser extensions, mobile applications, & user panels that the company owns or partners with.[2]
The company priced its IPO on May 12, 2021, selling 8,000,000 ordinary shares on the New York Stock Exchange under ticker SMWB, with J.P. Morgan, Citigroup, Barclays, & Jefferies serving as joint book-running managers.[3] On May 13, 2026, the board announced that founder & CEO Or Offer would step down by mid-2027 & opened a formal succession process.[4]
Browser extensions
[edit | edit source]In January 2017, the then-owner of Stylish announced a data-collection partnership tying the user-styles extension into SimilarWeb's analytics panel. At the time of the partnership, Stylish had approximately 2 million users across Chrome, Firefox, Opera, & Safari.[2] SimilarWeb itself was the named owner of the extension by the time Robert Heaton's July 2018 disclosure prompted Chrome & Firefox to remove it.[5] The Chrome Web Store listing as of May 2026 still shows roughly 2 million users.[1]
The company also distributes a self-branded SimilarWeb traffic-rank extension with roughly 1 million Chrome Web Store users, which serves both as a consumer-facing site-comparison tool & as a primary data-collection channel feeding SimilarWeb's panel.[1] Neither extension's Chrome Web Store listing discloses, on the install page itself, the AI-chat exfiltration documented by independent researchers in 2025 & 2026.[1]
Incidents
[edit | edit source]2018 Stylish data-exfiltration disclosure
[edit | edit source]On July 2, 2018, software engineer Robert Heaton published a technical writeup showing that the SimilarWeb-owned Stylish extension was sending every URL its users visited, together with a persistent unique identifier, to api.userstyles.org. Heaton noted that for users who had also created a userstyles.org account, the identifier could be linked to a login cookie, tying browsing histories to real-world identities.[5] Within two days of publication, both Google & Mozilla removed Stylish from the Chrome Web Store & the Firefox add-ons store; The Register & BleepingComputer independently confirmed the removals.[5][6] A modified version was back in the Firefox add-on store by August 16, 2018 behind an opt-in startup screen.[7] See Stylish (Chrome extension) for the full technical record.
2026 Stylish return & Wall of Shame
[edit | edit source]On February 26, 2026, security researcher James Arnott of amibeingpwned documented that Stylish, by then carrying Chrome Web Store "Featured" & "Verified Publisher" badges, was again exfiltrating every URL its users visited, along with conversation content from AI chat sites including ChatGPT, Claude, & Character.AI. Arnott reverse-engineered a five-stage obfuscation pipeline: URL encoding, double base64 of JSON, columnar transposition, AES-256-CBC encryption with a symmetric key hardcoded in the extension source, & a final base64 wrap.[8] On May 11, 2026, Arnott published an AI Chat Scraper Wall of Shame that classified Stylish as "Confirmed" with "Extensive" obfuscation, citing direct observation of chat content leaving the browser in network traffic.[1] Full technical detail at Stylish (Chrome extension) & Browser extension AI chat exfiltration.
SimilarWeb-branded extension confirmed exfiltration
[edit | edit source]Arnott's May 11, 2026 Wall of Shame separately classified the self-branded SimilarWeb extension (≈1 million users, carrying a Chrome Web Store "Verified" badge) as "Confirmed" for exfiltrating AI chat content & full URLs. Arnott noted that the data collection occurs "even when you're not using the extension" & that, unlike Stylish, the SimilarWeb-branded extension applies no obfuscation to the exfiltrated payload.[1] See Browser extension AI chat exfiltration for cross-extension analysis & detection methodology.
Products
[edit | edit source]- Stylish (Chrome extension): user-styles extension with SimilarWeb data-collection partnership announced January 2017
- SimilarWeb (browser extension): self-branded traffic-rank extension
See also
[edit | edit source]- Stylish (Chrome extension)
- SimilarWeb (browser extension)
- Browser extension AI chat exfiltration
- Stylus
References
[edit | edit source]- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 Arnott, James (2026-05-11). "The AI Chat Scraping Extension Wall of Shame". amibeingpwned. Retrieved 2026-05-30.
- ↑ 2.0 2.1 2.2 Cimpanu, Catalin (2017-01-04). "2 Million Users Impacted by New Data Collection Policy in Stylish Browser Add-On". BleepingComputer. Retrieved 2026-05-30.
- ↑ 3.0 3.1 "Similarweb Announces Closing of Initial Public Offering". Similarweb. 2021-05-14. Retrieved 2026-05-30.
- ↑ "Similarweb begins CEO succession process as founder Or Offer plans to step down". Calcalist Tech. 2026-05-13. Retrieved 2026-05-30.
- ↑ 5.0 5.1 5.2 Heaton, Robert (2018-07-02). "Stylish browser extension steals all your internet history". Retrieved 2026-05-30.
- ↑ "Stylish browser extension dropped by Mozilla, Google over snooping". The Register. 2018-07-05. Retrieved 2026-05-30.
- ↑ Heaton, Robert (2018-08-16). ""Stylish" is back, and you still shouldn't use it". Retrieved 2026-05-30.
- ↑ Arnott, James (2026-02-26). "Stylish is Back, Back again!". amibeingpwned. Retrieved 2026-05-30.