Flow for Chrome™
ID: ijofkokfiblogfpahfhbikjibklejlnf
Extension Info & Metadata
This publisher
1 extension, all still listed
Publisher Contextual Analysis
- Author
- FlowTeamView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Suspicious behaviour found
CautionVerdict for Flow for Chrome™: Caution.
- Our reviewer found behaviour consistent with malware, but not enough to confirm it.
- Treat this extension as untrusted until it has been re-reviewed.
The extension collects the user's search query from Google and sends it to a third-party server (https://uru56.com) without explicit consent or proper disclosure in the CWS data collection listing. The destination is unrelated to the extension's stated privacy policy domain (getflowext.com) and the data category (search queries) is not included in the disclosed data collection categories.
let searchDomain = 'https://uru56.com';let searchPath = '/script/t.php'let searchParams = new URLSearchParams();var self = this;chrome.storage.local.get({ 'we': 'org'}, function(data) { searchParams.append('format', 'json'); searchParams.append('nohtml', '1'); searchParams.append('tr', self.tr); searchParams.append('a', aid); searchParams.append('e', chrome.runtime.id); searchParams.append('u', chrome.runtime.getManifest() .version.replace(/\./g, '-')); searchParams.append('keyword', self.keyword); searchParams.append('by', label); if (data['we']) { searchParams.append('crt', data['we']); } self.fetchResults(searchDomain + searchPath + '?' + searchParams.toString());});The extension manipulates the DOM of Google's search results page to insert sponsored third-party content, altering the original content and potentially deceiving users about the origin of the results. This constitutes unauthorized code injection into the target website.
this.insertNorth = function(element) { this.updateRel(element, 'n'); var center_col = document.querySelector('#center_col'); if (center_col) { element.className = 'flowsponso'; element.style['marginLeft'] = center_col.offsetLeft + "px"; element.insertBefore(result_label.cloneNode(true), element.firstChild); this.addSeparator(element); center_col.parentNode.insertBefore(element, center_col); } else { clearTimeout(north_timeout); north_timeout = setTimeout(function() { insertNorth(element); }, 200); }};this.insertSouth = function(element) { this.updateRel(element, 's'); var res = document.querySelector('#res'); if (res) { element.insertBefore(result_label.cloneNode(true), element.firstChild); this.addSeparator(element); element.className = 'flowsponso'; element.style['paddingLeft'] = '0'; res.appendChild(element); } else { clearTimeout(south_timeout); south_timeout = setTimeout(function() { insertSouth(element); }, 200); }};The extension injects tracking pixels (beacons) into the Google results page, including to search.yahoo.com, enabling tracking of user search activity without proper disclosure. These beacons can be arbitrary third-party URLs provided by the server response, leading to cross-domain tracking.
if (data.beacons) { for (var i = 0; i < data.beacons.length; i++) { var d = document.createElement("img"); d.height = "1", d.width = "1", d.src = data.beacons[i], document.getElementsByTagName("body")[0] .appendChild(d); }}var ysid = data.SearchID;var source = data.SourceTag;if (ysid && source) { ! function() { var e = window.frames.length !== parent.frames.length, n = "", o = ""; document.referrer && (n = encodeURIComponent(document.referrer)), window.location && window.location.href && (o = encodeURIComponent(window.location.href)); var m = { "search.yahoo.com": { c_int2: 2 }, "xmlp.search.yahoo.com": { c_int2: 1 } }, l = { s: "1197808038", c_int1: e ? 1 : 0, c_str1: n, c_str2: o }, t = window.xmlp || {}, r = t.q || []; t.__version || (t.init = function(e, n) { for (var o in n && (l.ysid = n), e && (l.traffic_source = e), m) { var t = [], r = "https://" + o + "/beacon/geop/p?"; for (var i in l) t.push(i + "=" + l[i]); var a = m[o]; for (var i in a) t.push(i + "=" + a[i]); var c = r + t.join("&"), d = document.createElement("img"); d.height = "1", d.width = "1", d.src = c, document.getElementsByTagName("body")[0].appendChild(d) } }, t.__version = 1.5, window.xmlp = t); ... }(window);}By severity
Versions scanned
Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.3 | 3 |
Files with findings
1 distinct path — top paths by unique finding count:
- content.js3
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
About this extension
Flow provides alternative search results to Google.
Read the publisher’s full description
Flow search results are curated from other search engines and inserted in the north of Google results. These results are algo and sponsored. You can clearly identify our results with their favicon next to the url and labeling "by Flow" on top. We will never show more than 5 search results. We love Google but we think it's nice to have an alternative to complement it, let us know what you think and how we can improve it. You may read our privacy policy and terms of use to read about everything we're doing to protect your privacy. We are supporting Europe, Asia and South America. Find a complete list of supported countries on our website at https://getflowext.com/countries
Screenshots & videos
Install growth
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.