Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Content Site Search Guru, used by 40,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by other. It comes from a trusted publisher and was last updated in August 2025.
Key findings
- Medium
Other
Any page on `*.[domain withheld]` (the `externally_connectable` match) can send the bare string `open_thank_you_page` and cause the extension to close every tab in every popup-type window in the entire browser, not just its own UI - `chrome.tabs.query({windowType:'popup'})` is browser-wide and unfiltered by extension origin. A remotely-triggered "close all popups" primitive is an install-funnel artifact: it lets the operator's landing page suppress popup windows around the moment of install, and it corroborates the recurring review complaints that the extension was "installed without user permission" and that users "didn't realize it was installed". Nothing in the listing's stated purpose (address-bar content-site search) requires remotely closing unrelated browser windows.
Analyst notes
This is monetized search-redirect grayware, not a data-theft or code-injection extension. The only real behaviour in the 4 code files is a `chrome_settings_overrides.search_provider` with `is_default: true` pointing every address-bar search at `[domain withheld]}` with an affiliate id, a settings page that lets the user pick which upstream engine [domain withheld] proxies to (), a `chrome.cookies.set` on `.[domain withheld]` behind the optional `cookies` permission requested on a user gesture, and an uninstall ping (:44). [domain withheld] is the operator's own backend (:70-76 routes the extension's footer links to `[domain withheld]), and search queries fall under the CWS-disclosed "Web history, User activity", so the query flow is first-party and by-disclosure, not exfiltration; the bundled manifest also matches the published CWS summary exactly (storage, optional cookies, externally_connectable to *.[domain withheld], WAR) - no mismatch. What keeps this above `likely_benign` is:23-30 plus 82-90: any `*.[domain withheld]` page can send `open_thank_you_page` and the extension closes every tab in every popup-type window in the browser, which is an artifact and lines up with the "installed without user permission" and "often switches search engine to Yahoo or Bing" review complaints. Contradicting the ML score: no anywhere in the extension's own code, and the 14 `js_hex_obfuscation` hits are not malice - 10 are in unmodified jQuery 3.5.1 (` `) and the remaining ~4 sit in ` `, a typing-animation library that is referenced by:132 but absent from this bundle. The permhash cluster (10% malware over 193,971 versions sharing only storage+cookies) is too generic to carry weight, and the malext-feed note self-describes as a feed import rather than a code review, so I do not escalate on it.
Content Site Search Guru Chrome extension security report
ID: fgomgoininjjcilkdpghijnhmlagbndk
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- sites-guru.com
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Provides an easy and pleasant search of content on the content sites directly from your browser's address bar.
Read the publisher’s full description
Are you frustrated sometimes with the built-in search engine of large content sites? Did you once get lost on the sites and didn't manage to find the topics you wanted to look for? Were you curious about how to look efficiently for articles and for certain topics on a news website? This extension is a Chrome extension that dedicates to providing an easy and pleasant content search experience from your browser’s address bar. How does it work? 1. Type @ in the address bar to activate the quick commands. 2. After @, add the domain name of the website that you want to look on 3. Type your query after a space, example: @techcrunch dual-screen 4. Press Enter and go to the result page. Permissions used and reasons: 1. Access to “cookies” (optional). We require this permission to customize and modify your search engine as well as to keep autocomplete default suggestions. It’s optional because if you don’t allow permission to use cookies, we will not need it. Once after you grant permission to use cookies, you can always revoke it at any time. 2. Change your default search engine to our private domain search.searchsafe.tech powered by Yahoo. We require this permission to use our domain as a placeholder and to provide you the functionality in the autocomplete suggestions of your address bar. Inside this extension, we support Yahoo, Google, and Bing. You can switch to a different provider at any time inside the Settings section. How to remove this extension? If you want to remove our extension, go to “Settings” on Chrome, and find our extension in the “Extensions” tab. Click “remove”. Alternatively, you can right-click on the extension’s icon on your browser and select “Uninstall” from the drop-down menu. Chrome™ is a trademark of Google LLC. The use of it does not imply any affiliation to or endorsement by Google LLC. By adding this extension to your Chrome browser, you accept and agree to our Privacy Policy and End-User License Agreement. Privacy: https://www.sites-guru.com/privacy Terms: https://www.sites-guru.com/terms FAQ: https://www.sites-guru.com/#faq Contact: https://www.sites-guru.com/contact Uninstall: https://www.sites-guru.com/uninstall
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持87,000,000 users
- Claude19,000,000 users
- Zotero Connector9,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users