Security Alert: Confirmed Malware
Browse Safely
ID: mcfmgcffbobkodpgehgkppiclknnnoad
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- http://browsesafelyapp.comView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
Displays SitesRank Scores of domains in the autocomplete suggestions of the Chrome address bar.
Despite the convenience and the time saved by the autocomplete suggestions from your Chrome browser’s address bar, not all the website URLs popping up in the autocomplete will necessarily lead you to a safe destination with appropriate content. This is a Chrome extension that integrates WOT’s website rating system to display the SitesRank safety scores of each domain that appears in your autocomplete suggestions. Before clicking on any domains, view the safety scores first to avoid the low-rating and suspicious sites to stay away from bad content. We also provide an alternative option for you to check URLs inside the extension’s user interface. Please enter a valid URL (example: amazon.com). What is WOT? Web of Trust is a website reputation and review service that helps people make informed decisions about whether to trust a website or not. In this extension, we integrate with the WOT API. We are not responsible for their rating scores and cannot guarantee that the scores are 100% accurate. The SitesRank Scores can be turned off at any time from the extension’s action window. Don’t forget to turn it on afterward! Permissions and reasons used: 1. Access to “cookies”. We require this permission to remember all the setting changes that you made to provide you the customized experience you desire. 2. Access to “contextMenus”. We require this permission to add more functional items to the drop-down menu from the action icon of this extension to provide you a more complete user experience and to enhance our service. 3. Change your default search engine. We require this permission to change your default search engine to our search domain browsesafelysearch.com, powered by Yahoo. We need to change your default search engine in order to provide the functionality of displaying SitesRank Scores from the autocomplete suggestions of your address bar. If you want to use a different option, we also support Bing and Google in this extension. You can make the change from inside the extension’s Settings at any time. How to remove this extension? Option 1: Go to “Settings” on Chrome, and find our extension in the “Extensions” tab. Click “remove”. Option 2: Right-click on the extension’s icon on your browser and select “Remove from Chrome” from the drop-down menu. Chrome™ is a trademark of Google LLC. The use of it does not imply any affiliation to or endorsement by Google LLC. By adding this extension to your Chrome browser, you accept and agree to our Privacy Policy and End-User License Agreement. Privacy Policy: https://www.browsesafelyapp.com/privacy EULA: https://www.browsesafelyapp.com/terms FAQ: https://www.browsesafelyapp.com/#faqs Contact Us: https://www.browsesafelyapp.com/contact Uninstall: https://www.browsesafelyapp.com/uninstall
The extension silently overrides the browser's default search engine to browsesafelysearch.com using the Yahoo affiliate partner code 'yspr'. Every search query the user types is monetized through Yahoo's partner program, routed via the publisher's domain. This is the core browser-hijacking mechanism — the 'security' framing is a pretext.
{ "chrome_settings_overrides": { "search_provider": { "encoding": "UTF-8", "favicon_url": "https://www.browsesafelysearch.com/favicon.ico", "is_default": true, "name": "Browse Safely", "keyword": "Browse Safely", "search_url": "https://www.browsesafelysearch.com/search/?category=web&s=yspr&vert=private&q={searchTerms}", "suggest_url": "https://sug.browsesafelysearch.com/v1/sug/?yid=yspr&vert=private&q={searchTerms}" } }}A content script injected into all Yahoo.com pages detects when the user lands on the affiliate partner search page (hspart=iba parameter) and conditionally overlays a 'keep changes' UI element sourced from the extension. This is a deliberate social-engineering retention mechanism designed to prevent users from undoing the search engine hijack — not a security feature.
if (location.href.indexOf('hspart=iba') > 0) { chrome.runtime.sendMessage({ message: 'show_keep_changes' }, show => { if (show !== null && show instanceof Object) { if (show.value === '1') { showKeepChanges(); } } });}Every domain the user manually enters into the extension's popup is transmitted to sug.browsesafelysearch.com/v1/wotapi/ (the publisher's server). This leaks the user's domain-lookup queries to the publisher with no disclosed data retention policy, under the guise of providing safety scores.
function fetchDomain(value) { ... if (isUrl(value)) { fetch(`${config.wotApiUrl}${value}`) .then(res => res.json()) .then((domainData) => {A postMessage bridge is established on all browsesafelysearch.com pages, allowing arbitrary page content to call chrome.runtime.sendMessage and receive extension responses. If the publisher's domain is ever compromised or serves malicious content, this bridge provides a direct channel to invoke extension capabilities (including cookie access) from the webpage.
window.addEventListener('message', event => { if (event.source !== window) { console.log('Only accepting messages from ourselves!'); return; } chrome.runtime.sendMessage(event.data, response => { event.source.postMessage(response, event.origin); });}, false);By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.0 | 4 |
Files with findings
4 distinct paths — top paths by unique finding count:
- content_script/contentScript.js1
- content_script/first_search/keep_changes.js1
- manifest.json1
- popup/main.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.