Chrome Web Store
22Versions
1Code reviewed

No malware found

In code review (v3.25.0.6)

Our reviewer read version 3.25.0.6 โ€” the most recent version we have reviewed โ€” and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Norton Safe Search, used by 5,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in September 2026.

The extension is from a trusted publisher (Gen Digital, formerly NortonLifeLock) and its manifest permissions align with its described functionality of safe search and site safety ratings. The provided code files (manifest, service worker, i18n, CSS) reveal no suspicious behavior; the service worker merely imports core scripts that were not included in the analysis bundle. The permissions are necessary for URL interception and page annotation, and the disclosed data collection (location, user activity) matches the stated purpose. No evidence of unauthorized data exfiltration or malicious injection was found.

Norton Safe Search

Norton Safe Search Chrome extension security report

ID: mpnlkmlkncncpgnnkmkgoobfpnjmblnk

Supported Languages

๐Ÿ‡ธ๐Ÿ‡ฆArabic
๐Ÿ‡ง๐Ÿ‡ทBrazilian Portuguese
๐Ÿ‡จ๐Ÿ‡ณChinese (Simplified)
๐Ÿ‡น๐Ÿ‡ผChinese (Traditional)
๐Ÿ‡จ๐Ÿ‡ฟCzech
๐Ÿ‡ฉ๐Ÿ‡ฐDanish
๐Ÿ‡ณ๐Ÿ‡ฑDutch
๐Ÿ‡บ๐Ÿ‡ธEnglish
๐Ÿ‡ซ๐Ÿ‡ฎFinnish
๐Ÿ‡ซ๐Ÿ‡ทFrench
๐Ÿ‡ฉ๐Ÿ‡ชGerman
๐Ÿ‡ฌ๐Ÿ‡ทGreek
๐Ÿ‡ฎ๐Ÿ‡ฑHebrew
๐Ÿ‡ญ๐Ÿ‡บHungarian
๐Ÿ‡ฎ๐Ÿ‡นItalian
๐Ÿ‡ฏ๐Ÿ‡ตJapanese
๐Ÿ‡ฐ๐Ÿ‡ทKorean
๐Ÿ‡ณ๐Ÿ‡ดNorwegian
๐Ÿ‡ต๐Ÿ‡ฑPolish
๐Ÿ‡ท๐Ÿ‡ดRomanian
๐Ÿ‡ท๐Ÿ‡บRussian
๐Ÿ‡ช๐Ÿ‡ธSpanish
๐Ÿ‡ธ๐Ÿ‡ชSwedish
๐Ÿ‡น๐Ÿ‡ทTurkish

Extension Info & Metadata

Status
Active
Version
3.25.0.16
Size
5.90 MB
Rating
2.4/5
Reviews
360
Users
5,000,000
Type
Extension
Updated
Sep 20, 2026
Category
Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
4extensions
All still listed
Scanned by Extension Auditor โ€” Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
Gen Digital
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
4
Active
4
Obsolete
0
Listed
3
Unlisted
1
Users
11,660,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 1

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: โ€ข 10% increase: Early script execution enables pre-emptive content manipulation
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
*://nortonsafe.search.ask.com/
Host
Medium
Host permission โ€” access limited to this URL pattern.
https://ss-sym.search.ask.com/*
Host
Medium
Host permission โ€” access limited to this URL pattern.
https://*.norton.com/*
Host
Medium
Host permission โ€” access limited to this URL pattern.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

About this extension

Search safely online by enabling Norton Safe Search as your default search provider for maximum protection on Chrome.

Read the publisherโ€™s full description

Norton Safe Search helps protect you from identity thieves and online scams by warning you of dangerous sites when you search, shop or browse online. Norton Safe Search provides you added peace of mind by showing site safety ratings when a search by showing, 1. If the site is Trusted 2. If you should exercise additional caution 3. If the site is known to be malicious, which should be avoided. --- This extension uses permissions that produce the following Chrome messages to perform necessary functions within the extension. โ€œRead your browsing historyโ€ Shown for permissions needed for creation and management of tabs and information from the extensionโ€™s installation page. โ€œThis extension can read and change your data on sites. You can control which sites the extension can access.โ€ Shown for permissions needed for exchange of configuration information for performing safety markup on search results. โ€œChange your search settings to: searchsafe.norton.comโ€ Shown for permissions needed for delivery of search results through the Norton Safe Search service. This extension also uses permissions that are not displayed in Chrome for performing certain functions within the extension: โ€œwebRequestโ€ permission Used to obtain search terms from the omnibar/address bar. โ€œwebRequestBlockingโ€ permission Used to add data needed to perform safety markup on search results. โ€œstorageโ€ permission Used to store and retrieve settings data used by the extension. --- By using this add-on, you agree to our License and Services Agreement (https://www.nortonlifelock.com/content/dam/nortonlifelock/pdfs/eulas/licensing-agreement/customer-agreement-en.pdf) and have read and acknowledge our Global Privacy Statement (https://www.nortonlifelock.com/us/en/privacy/global-privacy-statement/). This add-on makes use of Google Analyticsโ€™s Measurement Protocol to transmit critical error and feature usage information to Google Analytics services. NortonLifeLock uses Google Analytics services to maintain and improve this add-on, but the services are not operated by NortonLifeLock. If you do not consent to this data collection and usage, please do not install this add-on or remove it if it is already installed. This add-on sets parameters that Google provides to obfuscate your IP address when processing Google Analytics. See more details here for our obligations to use Google Analytics, Googleโ€™s privacy practices, and Google's IP obfuscation support: - https://developers.google.com/analytics/policy - https://support.google.com/analytics/answer/6004245 - https://support.google.com/analytics/answer/2763052 Copyright ยฉ 2022 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries. Google Chrome is a trademark of Google, LLC. Other names may be trademarks of their respective owners.

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
3.25.0.16
Latest
5.90 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.25.0.15
5.90 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.25.0.12
5.90 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.25.0.6
5.90 MBNo malware found0
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.25.0.4
5.89 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.25.0.3
6.00 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.23.0.20
2.45 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.23.0.17
2.44 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.23.0.4
2.20 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
3.23.0.1
2.20 MBNot scannedโ€”
9cc53a125908492dfabb5354ec8bba0df0666a7bdcf099c628c83e7791a327e7
Showing 1 to 10 of 30 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.