Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: OneSearch

CRITICAL RISKRemoved from Chrome Web Store

OneSearch

ID: gnnmgfgecahpikkholgabepllnfbhkgj

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇬🇧British English

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇳🇱Dutch

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇩Indonesian

🇮🇹Italian

🇲🇽Latin American Spanish

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

2.0.5

Size

0.79 MB

Rating

3.8/5

Reviews

Users

10,000

Type

Extension

Updated

Sep 19, 2022

Publisher Contextual Analysis

Author: https://onesearch.comView Profile
Privacy: Privacy Policy
Help: Help Center
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 701 first avenue Sunnyvale, CA 94089 US
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

A powerful privacy-focused web search experience that gives you more control. Download the extension today!

OneSearch by Yahoo is the search extension that puts your privacy first. Find exactly what you’re looking for—without unwanted profile or ad targeting. OneSearch encrypts your search terms for extra security. Benefits include: - No Cookies - We don't use cookies. - Privacy first - We don't save your search terms or geographic location. - No user tracking - We don't track you or your personal data. - Encrypted search terms - Keywords are encrypted and protected. - No saved search history - We don't save or use your search history for ad targeting. - Results without bias - We don't use your habits or data to filter search results. - Filter out NSFW results - Turn on the SafeSearch feature to keep adult content out of results. - When you share links with others to your search results, the link will conveniently expire within the hour. Take control of your search privacy. Download the OneSearch extension today!

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 5 ratings

Average Rating

Current: 4.40 / 5.0-0.60

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium3

Low1

Versions scanned

Showing 1 of 13 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.5 Code review	8

Extension Version	Code Review Findings
2.0.5	8

Files with findings

5 distinct paths — top paths by unique finding count:

background.js4
crypto/cryptoGet.js1
hb-sw.js1
ui/popup.js1
utils-sw.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	high	background.js (line 168)	The extension installs two dynamic declarativeNetRequest rules: one injects a custom header ('x-extensions-installed: os-newtab-ext') into all requests to *.onesearch.com signaling the extension's presence to the back…	2.0.5
2	Privilege Escalation	high	ui/popup.js (line 322)	The extension requests optional host permission for '<all_urls>' (access to every website) at runtime via the Http2Https feature toggle. This escalates from the declared host_permissions of only '.onesearch.com/' to…	2.0.5
3	Remote Code Loading	high	utils-sw.js (line 76)	On every install, the extension fetches a remote JSON configuration from onesearch.com whose contents govern the extension's entire behavior: welcome page URL, goodbye page URL, layout, market availability, heartbeat …	2.0.5
4	Unauthorized Data Collection	high	background.js (line 361)	The extension actively deletes browser history entries for its own redirect page and all onesearch.com searches (those containing 'yext=0') every time a search is performed. This anti-forensics behavior destroys evide…	2.0.5
5	Tracking	medium	background.js (line 325)	On every search the extension updates the uninstall URL with precise time-since-installation delta, user market/region, distribution channel identifiers, campaign info, and version. This beacon fires automatically whe…	2.0.5
6	Tracking	medium	hb-sw.js (line 13)	The extension implements a comprehensive heartbeat and click-tracking system that fires beacons to onesearch.com on install, on every search (daily), and on UI interactions. Despite URLs containing '/notracking/', the…	2.0.5
7	Unauthorized Data Collection	medium	crypto/cryptoGet.js (line 79)	The extension fetches an RSA-OAEP public key from a remote onesearch.com API endpoint ('https://www.onesearch.com/kdata/v1/get') and uses it to encrypt every search query before sending it. The key is server-controlle…	2.0.5
8	Tracking	low	background.js (line 207)	On installation, the extension queries for open tabs matching a store URL pattern and silently modifies their URLs by appending '#extInstalled' — this communicates extension installation status to web pages without us…	2.0.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.onesearch.com	-	https://www.onesearch.com
chrome.google.com	/webstore/*	https://chrome.google.com/webstore/*
microsoftedge.microsoft.com	/addons/*	https://microsoftedge.microsoft.com/addons/*
addons.mozilla.org	/*	https://addons.mozilla.org/*
downloads.yahoo.com	/*	https://downloads.yahoo.com/*
downloads.yahoo.com	/onesearch*	https://downloads.yahoo.com/onesearch*
at.onesearch.com	/sugg/gossip/gossip-at-ura/	https://at.onesearch.com/sugg/gossip/gossip-at-ura/
ch.onesearch.com	/sugg/gossip/gossip-ch-ura/	https://ch.onesearch.com/sugg/gossip/gossip-ch-ura/
de.onesearch.com	/sugg/gossip/gossip-de-ura/	https://de.onesearch.com/sugg/gossip/gossip-de-ura/
au.onesearch.com	/sugg/gossip/gossip-au-ura/	https://au.onesearch.com/sugg/gossip/gossip-au-ura/

Showing 1 to 10 of 80 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


106.14.182.184	IPv4	-
148.115.223.19	IPv4	-
219.53.14.142	IPv4	-
19.186.243.101	IPv4	-
1.112.17.132	IPv4	-
137.106.27.22	IPv4	-
105.79.175.237	IPv4	-
145.175.27.211	IPv4	-
11.103.208.208	IPv4	-
158.175.27.202	IPv4	-
237.148.35.232	IPv4	-
245.208.118.48	IPv4	-
2.21.146.32	IPv4	-
31.116.41.1	IPv4	-
212.143.45.255	IPv4	-
127.105.24.214	IPv4	-
2.17.98.68	IPv4	-
106.142.22.195	IPv4	-

Showing 1 to 18 of 20 rows

Rows per page:

3.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

this 'extension' (add-on) 'Adds' Nothing. no search agent option, no search query string (url), no shortcut, Nothing. It's seems completely Useless.

Landis Reed (LandisTwo)·9 Jan 2023

this 'extension' (add-on) 'Adds' Nothing. no search agent option, no search query string (url), no shortcut, Nothing. It's seems completely Useless.

Landis Reed·9 Jan 2023

TRULY PRIVACY

njah !

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

OneSearch

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 13 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating