Extension Auditor
Extension Auditor
Sign Up

Custom Engines

ID: mkacjhofeafagblkflacbogbkdcmeabf

Could be malicious

Extension Info & Metadata

Status
Removed
Version
1.2
Size
0.13 MB
Rating
4.3/5
Reviews
43
Users
158,677
Type
Extension
Updated
Jan 11, 2021
Category
38_search_tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
Kyle LoView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
158,677

Add support to the omnibox dropdown to use in a preferred search engine

Quickly access alternative Search Engines when browsing. Simply type 'q' and press the space button in your browser address bar before typing your search keyword and choose your preferred search engine from the autofill section. Additionally, by clicking on the browser Icon, you can choose your default Search Engine that is always activated when you navigate your searches via address bar.

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
<all_urls>
Permission
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2

By severity

Critical3
High5
Medium3
Low1

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.112

Files with findings

2 distinct paths — top paths by unique finding count:

  • background.js10
  • eventPage.js2
S.No.
Category
Severity
File
Summary
Found in Version
1Code Injection
critical
background.js (line 318)This function dynamically constructs a JavaScript string using a server-supplied value (`linkvDiv`) and injects it into every open Linkvertise/link-to.net tab via `chrome.tabs.executeScript`. The injected code string …
1.1
2Network Interception
critical
background.js (line 507)The extension registers a `webRequest.onBeforeSendHeaders` listener on `<all_urls>`, giving it visibility into the headers and URLs of every outgoing HTTP/S request across all tabs. When a Google/Bing/Ecosia/Wikipedia…
1.1
3Remote Code Loading
critical
background.js (line 268)The extension fetches its entire configuration — including a server-assigned unique user token (`my_custom`) and all search engine URLs — from a remote server (`custom-engines.com`). The server fully controls what URL…
1.1
4Other
high
background.js (line 598)The extension remotely refreshes its engine definitions and overwrites stored `searchUrl` targets every six hours without requiring an extension update. Because those URLs are later used to redirect user searches, thi…
1.1
5Remote Code Loading
high
background.js (line 607)Every 6 hours, the extension fetches updated engine URLs from the remote server and overwrites the locally-stored search URLs (`defaultUrl`, `searchUrl`) without any user notification or integrity verification. This s…
1.1
6Tracking
high
background.js (line 339)The server response sets `my_custom` (a unique per-user token) and `linkvDiv` (a div ID used for linkvertise injection). Both values originate entirely from the remote server and are persisted to local storage, then u…
1.1
7Tracking
high
background.js (line 572)The extension phones home to the operator's server every 6 hours (or every 30 minutes if the server returns a non-OK response), transmitting the unique user token `my_custom`. This is a persistent heartbeat that allow…
1.1
8Unauthorized Data Collection
high
background.js (line 643)Both the uninstall URL and the welcome page URL embed the unique `my_custom` token as the `who=` query parameter, allowing the operator to correlate installs, uninstalls, and user locale with specific tracked identiti…
1.1
9Other
medium
eventPage.js (line 1)This content script, injected into every `link-to.net` and `linkvertise.com` page, fires a custom `addon-install` window event, explicitly signaling to the host page's JavaScript that this extension is installed. Link…
1.1
10Tracking
medium
eventPage.js (line 1)This content script runs on `link-to.net` and `linkvertise.com`, creates a hidden marker element using a background-provided identifier, and emits a custom `addon-install` event into the page. That behavior looks like…
1.1
11Tracking
medium
background.js (line 571)The extension periodically phones home to `https://custom-engines.com/check-in` with a persistent identifier (`my_custom`). Regular beaconing of a unique ID to a remote server is a tracking pattern and is not necessar…
1.1
12Obfuscation
low
background.js (line 366)The function named `encryptMessage` performs no encryption whatsoever — it is simply URL-encoding of key-value pairs, identical to standard form serialization. The misleading name suggests deliberate obfuscation of th…
1.1
URLs
8
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
custom-engines.com/create-customhttps://custom-engines.com/create-custom
custom-engines.com/create-engineshttps://custom-engines.com/create-engines
custom-engines.com/check-inhttps://custom-engines.com/check-in
custom-engines.com/delete/goodbye.phphttps://custom-engines.com/delete/goodbye.php?who=
custom-engines.com/add/start.phphttps://custom-engines.com/add/start.php?who=
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
*.link-to.net/*https://*.link-to.net/*
*.linkvertise.com/*https://*.linkvertise.com/*

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 3 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In