Browse Safely

ID: mcfmgcffbobkodpgehgkppiclknnnoad

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Removed
Version
3.0.0
Size
0.14 MB
Rating
1.8/5
Reviews
12
Users
100,000
Type
Extension
Updated
Jan 26, 2021
Category
38_search-tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
http://browsesafelyapp.comView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
100,000

Displays SitesRank Scores of domains in the autocomplete suggestions of the Chrome address bar.

Despite the convenience and the time saved by the autocomplete suggestions from your Chrome browser’s address bar, not all the website URLs popping up in the autocomplete will necessarily lead you to a safe destination with appropriate content. This is a Chrome extension that integrates WOT’s website rating system to display the SitesRank safety scores of each domain that appears in your autocomplete suggestions. Before clicking on any domains, view the safety scores first to avoid the low-rating and suspicious sites to stay away from bad content. We also provide an alternative option for you to check URLs inside the extension’s user interface. Please enter a valid URL (example: amazon.com). What is WOT? Web of Trust is a website reputation and review service that helps people make informed decisions about whether to trust a website or not. In this extension, we integrate with the WOT API. We are not responsible for their rating scores and cannot guarantee that the scores are 100% accurate. The SitesRank Scores can be turned off at any time from the extension’s action window. Don’t forget to turn it on afterward! Permissions and reasons used: 1. Access to “cookies”. We require this permission to remember all the setting changes that you made to provide you the customized experience you desire. 2. Access to “contextMenus”. We require this permission to add more functional items to the drop-down menu from the action icon of this extension to provide you a more complete user experience and to enhance our service. 3. Change your default search engine. We require this permission to change your default search engine to our search domain browsesafelysearch.com, powered by Yahoo. We need to change your default search engine in order to provide the functionality of displaying SitesRank Scores from the autocomplete suggestions of your address bar. If you want to use a different option, we also support Bing and Google in this extension. You can make the change from inside the extension’s Settings at any time. How to remove this extension? Option 1: Go to “Settings” on Chrome, and find our extension in the “Extensions” tab. Click “remove”. Option 2: Right-click on the extension’s icon on your browser and select “Remove from Chrome” from the drop-down menu. Chrome™ is a trademark of Google LLC. The use of it does not imply any affiliation to or endorsement by Google LLC. By adding this extension to your Chrome browser, you accept and agree to our Privacy Policy and End-User License Agreement. Privacy Policy: https://www.browsesafelyapp.com/privacy EULA: https://www.browsesafelyapp.com/terms FAQ: https://www.browsesafelyapp.com/#faqs Contact Us: https://www.browsesafelyapp.com/contact Uninstall: https://www.browsesafelyapp.com/uninstall

Item
Type
Severity
Description
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
*://*.browsesafelysearch.com/
Permission
Unknown
No classification available for this permission.

The extension silently overrides the browser's default search engine to browsesafelysearch.com using the Yahoo affiliate partner code 'yspr'. Every search query the user types is monetized through Yahoo's partner program, routed via the publisher's domain. This is the core browser-hijacking mechanism — the 'security' framing is a pretext.

manifest.json (Line 7)
{  "chrome_settings_overrides": {    "search_provider": {      "encoding": "UTF-8",      "favicon_url": "https://www.browsesafelysearch.com/favicon.ico",      "is_default": true,      "name": "Browse Safely",      "keyword": "Browse Safely",      "search_url": "https://www.browsesafelysearch.com/search/?category=web&s=yspr&vert=private&q={searchTerms}",      "suggest_url": "https://sug.browsesafelysearch.com/v1/sug/?yid=yspr&vert=private&q={searchTerms}"    }  }}

A content script injected into all Yahoo.com pages detects when the user lands on the affiliate partner search page (hspart=iba parameter) and conditionally overlays a 'keep changes' UI element sourced from the extension. This is a deliberate social-engineering retention mechanism designed to prevent users from undoing the search engine hijack — not a security feature.

content_script/first_search/keep_changes.js (Line 21)
if (location.href.indexOf('hspart=iba') > 0) {  chrome.runtime.sendMessage({    message: 'show_keep_changes'  }, show => {    if (show !== null && show instanceof Object) {      if (show.value === '1') {        showKeepChanges();      }    }  });}

Every domain the user manually enters into the extension's popup is transmitted to sug.browsesafelysearch.com/v1/wotapi/ (the publisher's server). This leaks the user's domain-lookup queries to the publisher with no disclosed data retention policy, under the guise of providing safety scores.

popup/main.js (Line 136)
function fetchDomain(value) {  ...  if (isUrl(value)) {    fetch(`${config.wotApiUrl}${value}`)      .then(res => res.json())      .then((domainData) => {

A postMessage bridge is established on all browsesafelysearch.com pages, allowing arbitrary page content to call chrome.runtime.sendMessage and receive extension responses. If the publisher's domain is ever compromised or serves malicious content, this bridge provides a direct channel to invoke extension capabilities (including cookie access) from the webpage.

content_script/contentScript.js (Line 31)
window.addEventListener('message', event => {  if (event.source !== window) {    console.log('Only accepting messages from ourselves!');    return;  }  chrome.runtime.sendMessage(event.data, response => {    event.source.postMessage(response, event.origin);  });}, false);

By severity

Critical0
High2
Medium2
Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
3.0.04

Files with findings

4 distinct paths — top paths by unique finding count:

  • content_script/contentScript.js1
  • content_script/first_search/keep_changes.js1
  • manifest.json1
  • popup/main.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Other
high
manifest.json (line 7)The extension silently overrides the browser's default search engine to browsesafelysearch.com using the Yahoo affiliate partner code 'yspr'. Every search query the user types is monetized through Yahoo's partner prog…
2Other
high
content_script/first_search/keep_changes.js (line 21)A content script injected into all Yahoo.com pages detects when the user lands on the affiliate partner search page (hspart=iba parameter) and conditionally overlays a 'keep changes' UI element sourced from the extens…
3Privilege Escalation
medium
content_script/contentScript.js (line 31)A postMessage bridge is established on all browsesafelysearch.com pages, allowing arbitrary page content to call chrome.runtime.sendMessage and receive extension responses. If the publisher's domain is ever compromise…
4Tracking
medium
popup/main.js (line 136)Every domain the user manually enters into the extension's popup is transmitted to sug.browsesafelysearch.com/v1/wotapi/ (the publisher's server). This leaks the user's domain-lookup queries to the publisher with no d…
URLs
12
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

${config.domain}`,-https://${config.domain}`,
sug.${domain}/v1/wotapi/https://sug.${domain}/v1/wotapi/?yid=yspr&vert=private&q=`
www.w3.org/2000/svghttp://www.w3.org/2000/svg
www.w3.org/1999/xlinkhttp://www.w3.org/1999/xlink
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
www.browsesafelysearch.com/favicon.icohttps://www.browsesafelysearch.com/favicon.ico
www.browsesafelysearch.com/search/https://www.browsesafelysearch.com/search/?category=web&s=yspr&vert=private&q={searchTerms}
sug.browsesafelysearch.com/v1/sug/https://sug.browsesafelysearch.com/v1/sug/?yid=yspr&vert=private&q={searchTerms}
www.browsesafelysearch.com/wim/ds/gotohubhttps://www.browsesafelysearch.com/wim/ds/gotohub?s=yspr
${config.domain}`},-https://${config.domain}`},
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Version
Size
Is Malicious
Findings
Permhash
3.0.0
Latest
0.14 MB
Malicious
4
Showing 1 to 1 of 10 rows
Rows per page:

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.