Is Advanced Auto Logout safe?

Low risk

Advanced Auto Logout ships a dormant tab-redirect module branded ‘Safety Redirector’ that isn't wired into this build's manifest.

The extension's files include a full navigation-monitoring system, called Safety Redirector, that checks every URL you visit against a rule list fetched from a remote server and would redirect the tab when a rule matches. It also generates a persistent random ID on install and would send it, along with a running counter, to the same server once a day. As shipped in version 8.0.2, this code lives in a background page that Chrome's Manifest V3 configuration never loads, so none of it currently runs.

Safety Redirector, LLC.v8.0.2Chrome Web Store
21Risk
Who publishes it

Safety Redirector, LLC. - 6 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Safety Redirector, LLC.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Advanced Auto Logout ships a dormant browser-redirect and tracking module

LowunwantedCWE-506Static analysis

Code analysis found a complete redirect and tracking module bundled in this build, but manifest.json never loads it, so it does not run in version 8.0.2.

What actually happens

You did this

You install this build and browse to any webpage.

The extension did this

Bundled code would check the page against a remote rule list and could redirect your tab without asking, but manifest.json never loads that code in this build.

The code that does this

What the manifest wires vs. what the package ships

Readable version

The page it ships but never loads, wiring in the redirect module

pages/background.html
<html><body><script type="text/javascript" src="/js/main.js"></script><script type="text/javascript" src="/js/Logout.js"></script><script type="text/javascript" src="/js/Options_logout.js"></script><script type="text/javascript" src="/js/background.js"></script></body></html>

The redirect module's navigation listener and rule fetch (js/main.js, would run if background.html ever loaded)

js/main.js
chrome.webNavigation.onBeforeNavigate.addListener(function(tab) {	ruleExists(tab, tab.url);});// ...xhr.open('GET', 'http://www.rules.safetyredirector.com/url_redirect3.php', true);xhr.send();// ...var newUrl = (/^https?:\/\//.test(rule[0]) ? '' : 'http://') + rule[0];chrome.tabs.update(tab.tabId, { url: newUrl });

What the module reads and sends, if it were wired in

  • Rule list fetch
    GET http://www.rules.safetyredirector.com/url_redirect3.php

    The code loads a block/redirect rule list from the developer's own server before checking your page.

  • Redirect destination
    http://example-affiliate.example/landing (illustrative; the real value comes from the remote rule list, not the code)

    On a rule match, your tab is sent to whatever URL that rule contains, with no confirmation dialog.

  • Device identifier
    K7pQz2XvB9nR4mLt8sYcW1oAeUiHfDg2 (illustrative; the code generates 255 random characters, shown shortened here)

    A random identifier is generated once at install and reused in every daily report.

  • Daily report
    POST http://www.rules.safetyredirector.com/track.php body: user_id=K7pQz2Xv...&malware=3&typos=0

    The device identifier and a running count of redirects are posted together, once per day, over plain HTTP.

Check if you're affected

Checks an unpacked extension's manifest.json for whether the redirect module has a real load path, versus this dormant build.

Requires
  • Python 3.8+
check_redirector_wiring.py · py
#!/usr/bin/env python3"""check_redirector_wiring.pyChecks whether an unpacked copy of this extension has re-wired thebundled 'Safety Redirector' redirect/tracking module. In version 8.0.2the module (pages/background.html -> js/main.js) ships but is neverloaded, because Manifest V3 has no background 'page'/'html' key.Usage:    python3 check_redirector_wiring.py /path/to/unpacked_extensionExit code 0: no reachable load path found (module still dormant).Exit code 1: a load path was found (module may be reachable)."""import jsonimport osimport sysdef main():    if len(sys.argv) != 2:        print(__doc__)        sys.exit(2)    ext_dir = sys.argv[1]    manifest_path = os.path.join(ext_dir, "manifest.json")    with open(manifest_path, "r", encoding="utf-8") as f:        manifest = json.load(f)    bg = manifest.get("background", {})    findings = []    # MV2-style background page/scripts keys would give background.html    # (and whatever it script-tags) a real load path.    if "page" in bg:        findings.append(f"background.page = {bg['page']!r}")    if "scripts" in bg:        findings.append(f"background.scripts = {bg['scripts']!r}")    # Anything other than exactly the shipped service worker is worth a look.    sw = bg.get("service_worker")    if sw and sw != "js/background.js":        findings.append(f"background.service_worker changed to {sw!r}")    if findings:        print("Reachable load path found:")        for item in findings:            print(f"  - {item}")        sys.exit(1)    print("No load path to background.html / js/main.js in this manifest.")    print("The redirect and tracking module remains dormant.")    sys.exit(0)if __name__ == "__main__":    main()
How to run it
  1. 1Unpack the CRX.
  2. 2Run: python3 check_redirector_wiring.py <unpacked_dir>.
  3. 3Exit code 1 means re-check the build for reactivation.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 8.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Schedule its own background tasks

    alarms

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Advanced Auto Logout contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.rules.safetyredirector.com

    Advanced Auto Logout sends data to www.rules.safetyredirector.com. 4 other extensions we have analyzed send data here.

Updated 2 November 2026dfmneckodhidoicepmbegcjifhmhhppg