Is Add Results safe?

Medium risk

Add Results is medium risk. When you search on Google, Add Results reads your query and sends it to hupzal.com before results load. The server returns HTML the extension injects atop your results, labeled "Ads by Add Results", on every search across regional domains.

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Search Queries Sent to hupzal.com for Ad Injection

When you search on Google, Add Results reads your query and sends it to hupzal.com before results load.

The server returns HTML the extension injects atop your results, labeled "Ads by Add Results", on every search across regional domains.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You type a search query into Google and press Enter.

This fires on any google.* domain, across all regional TLDs.

The extension did this

The extension sends your exact search query to hupzal.com and injects the response into your results page.

A GET request to hupzal.com/en/extension?q=<your query> is made before your search results are visible; the returned HTML is inserted at the top of the results.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.hupzal.com/en/extension?q=best+password+manager
HTTP 200, HTML fragment containing ad content. Injected into Google results via innerHTML at the top of #center_col.
03EvidenceCODE COMPARE
The code that does this

Query extraction and transmission (app.js)

What it actually does
// app.js lines 20-29
// chrome.i18n.getMessage('appWebsite') resolves to 'https://www.hupzal.com/en/'
// so the full URL is: https://www.hupzal.com/en/extension?q=<search query>
var rq = new XMLHttpRequest();
rq.open('GET', 'https://www.hupzal.com/en/extension?q=' + q, true);
rq.onload = function() {
    if (this.status >= 200 && this.status < 400) {
        resolve(this.response);  // HTML ad content returned
    }
};
rq.send();
04EvidenceFIELD TABLE
Data transmitted to hupzal.com on each search
FieldValueWhy it matters
Search query
best password manager 2025The full text of what you searched for is sent to hupzal.com's servers before results load.
Implicit origin
203.0.113.47 (user IP, visible server-side)The request carries your browser's IP address and any cookies hupzal.com has set, enabling cross-search session tracking.
05EvidenceTHIRD PARTY LIST
Where your search queries are sent
  • www.hupzal.com

    Receives every search query and returns ad HTML for injection into Google results. Operator of the 'Add Results' extension. Not named in the Chrome Web Store listing.

Updated 30 September 2026olkcmjmnlaepdbemdbbpgpkabemfpand