Chrome Web StoreDo not install
Code review: critical (v1.012)
Our reviewer read version 1.012 of this extension and confirmed malicious behaviour. 4 security findings documented below. Do not install it. Remove it if you already have it.
14 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Omni Convert - Search Settings for Omnibar, used by 3,000 people, is rated malicious by Extension Auditor. Our code review reported 4 findings (1 critical, 3 high), led by network interception. It comes from a trusted publisher and was last updated in September 2022.
Key findings
- Critical
Network Interception
A blocking webRequest listener intercepts the hijacked default-search URL and rewrites it to whatever `newurl` holds, defaulting to the hardcoded third-party `[domain withheld] (:1). `newurl` is initialised to `''` (:2) and is only ever assigned inside the `storage.onChanged` handler — the stored `se` value is never read at background-script startup — so after every browser restart all users are silently redirected to the madmidas affiliate feed regardless of the engine they selected, while:3-8 continues to render their choice as active. The affiliate parameter `gd=SY1003141` shows the redirect exists to monetise the query stream, and the listing's promise to set search to Bing is never honoured by any code path.
- High
Unauthorized Data Collection
On install the extension writes `[domain withheld]` as the stored search engine, so from the first query onward the user's full search terms are transmitted to a domain that is neither the publisher's website, the privacy-policy host (`[domain withheld]`), nor any SaaS the Tools category justifies. The CWS disclosure for this listing is "none declared", so transmitting search queries — user-activity data — to any endpoint, let alone an unrelated affiliate-tagged third party, is undisclosed collection. The adjacent install ping to `[domain withheld]` is by contrast first-party and is not part of this finding.
- High
Other
Every "search engine" the popup offers — branded with Bing, Yahoo, Google, Ask and Wikipedia logos — points at the same `[domain withheld]>&pid=24&zid=N&q=` monetisation endpoint rather than at the engine shown; the only thing that varies is the affiliate `uid`/`zid` pair. Combined with:47-62, which feeds the user's query into whichever of these strings is stored, the branded UI misrepresents where queries are sent and what the user is choosing between, which is a deceptive interface over the search-redirect monetisation rather than a search-provider selector.
- High
Other
The bundled manifest is MV2 with `webRequest`/`webRequestBlocking`, while the live CWS listing reports MV3 with `declarativeNetRequest` and host `*://[domain withheld]; this is most likely a later MV3 port of the same extension rather than a swapped package, since this reviewed version is 1467 days old. It does not reduce the risk: DNR plus the same `[domain withheld]` host grants the identical ability to rewrite the hijacked search URL to an off-site destination, so the redirect capability documented above survives the migration. Reported so the version delta is explicit rather than silently assumed equivalent.
Analyst notes
This is a monetized search hijacker, not a false positive::8-16 forcibly sets the default search provider to the extension's own endpoint (`[domain withheld]}`), and:77-80 registers a blocking `webRequest.onBeforeRequest` listener on exactly that URL which rewrites every query into `[domain withheld] (:1, 50-62) — an affiliate-tagged third-party domain that appears nowhere in the listing, the privacy-policy host, or the CWS data-collection disclosure ("none declared"). Because `newurl` is only ever populated from `storage.onChanged` (:65-76) and never read at startup, every browser restart silently reverts all users to the madmidas feed while:3-8 still highlights their chosen engine, and the listing text promises Bing. Corroborating: the permhash cluster is flagged malicious and chrome-stats independently flags `permission-override-search-provider` plus three invalid publisher URLs;: the risk engine's "can observe all network traffic" is wrong here — host permissions are only `*.[domain withheld]` and the listener filter is a single `main_frame` URL, so interception is narrow, and the ML's `js_eval_function` hit is a commented-out eval at:33 while `js_xmlhttprequest` is a benign first-party install ping, so the model reached the right verdict off the wrong features.
Omni Convert - Search Settings for Omnibar Chrome extension security report
ID: fgnfdemimflmkkmdilkloicmdigmjghp
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- clipconverter.site
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
14 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Omni Convert - Search Settings for Omnibar.
Read the publisher’s full description
Omni Convert is a simple and lite extension that enables you to search across many different search engines with ease that can easily be converted by using the Omni widget. The Omni Convert Chrome Extension will change your default search engine to Bing and allow you to seamlessly manage your favorite search providers. Important By clicking "Add to Chrome", I accept and agree to installing the Omni Convert extension and setting my default search to that provided by the service, the Privacy Policy, and the Terms of Use. How does it work? 1. The extension configures your browser’s default search engine to Bing 2. Search for any content through your Omni address bar 3. Easily convert between multiple search engines Using an Omnibar search widget gives you the fastest way to customize and control your search options. Privacy Policy: https://lp.clipconverter.site/privacy.html Terms of Service: https://lp.clipconverter.site/tos.html Contact us by email at clipconvertersite@gmail.com We hope that you enjoy our extension and it improves your internet experience. We welcome any feedback you have.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
14 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Tools
- 迅雷下载支持86,000,000 users
- Claude20,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users