Is Advanced Auto Logout safe?
Advanced Auto Logout ships a dormant tab-redirect module branded ‘Safety Redirector’ that isn't wired into this build's manifest.
The extension's files include a full navigation-monitoring system, called Safety Redirector, that checks every URL you visit against a rule list fetched from a remote server and would redirect the tab when a rule matches. It also generates a persistent random ID on install and would send it, along with a running counter, to the same server once a day. As shipped in version 8.0.2, this code lives in a background page that Chrome's Manifest V3 configuration never loads, so none of it currently runs.
Who publishes itSafety Redirector, LLC. - 6 other listings from the same operator, 1 of them carrying a finding
Safety Redirector, LLC. - 6 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 10k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Advanced Auto Logout ships a dormant browser-redirect and tracking module
Code analysis found a complete redirect and tracking module bundled in this build, but manifest.json never loads it, so it does not run in version 8.0.2.
If reconnected, it can redirect any page you visit without asking.
What actually happens
You install this build and browse to any webpage.
Bundled code would check the page against a remote rule list and could redirect your tab without asking, but manifest.json never loads that code in this build.
The code that does this
What the manifest wires vs. what the package ships
The page it ships but never loads, wiring in the redirect module
pages/background.html<html><body><script type="text/javascript" src="/js/main.js"></script><script type="text/javascript" src="/js/Logout.js"></script><script type="text/javascript" src="/js/Options_logout.js"></script><script type="text/javascript" src="/js/background.js"></script></body></html>The redirect module's navigation listener and rule fetch (js/main.js, would run if background.html ever loaded)
js/main.jschrome.webNavigation.onBeforeNavigate.addListener(function(tab) { ruleExists(tab, tab.url);});// ...xhr.open('GET', 'http://www.rules.safetyredirector.com/url_redirect3.php', true);xhr.send();// ...var newUrl = (/^https?:\/\//.test(rule[0]) ? '' : 'http://') + rule[0];chrome.tabs.update(tab.tabId, { url: newUrl });What the module reads and sends, if it were wired in
- Rule list fetchGET http://www.rules.safetyredirector.com/url_redirect3.php
The code loads a block/redirect rule list from the developer's own server before checking your page.
- Redirect destinationhttp://example-affiliate.example/landing (illustrative; the real value comes from the remote rule list, not the code)
On a rule match, your tab is sent to whatever URL that rule contains, with no confirmation dialog.
- Device identifierK7pQz2XvB9nR4mLt8sYcW1oAeUiHfDg2 (illustrative; the code generates 255 random characters, shown shortened here)
A random identifier is generated once at install and reused in every daily report.
- Daily reportPOST http://www.rules.safetyredirector.com/track.php body: user_id=K7pQz2Xv...&malware=3&typos=0
The device identifier and a running count of redirects are posted together, once per day, over plain HTTP.
Check if you're affected
Checks an unpacked extension's manifest.json for whether the redirect module has a real load path, versus this dormant build.
- Python 3.8+
#!/usr/bin/env python3"""check_redirector_wiring.pyChecks whether an unpacked copy of this extension has re-wired thebundled 'Safety Redirector' redirect/tracking module. In version 8.0.2the module (pages/background.html -> js/main.js) ships but is neverloaded, because Manifest V3 has no background 'page'/'html' key.Usage: python3 check_redirector_wiring.py /path/to/unpacked_extensionExit code 0: no reachable load path found (module still dormant).Exit code 1: a load path was found (module may be reachable)."""import jsonimport osimport sysdef main(): if len(sys.argv) != 2: print(__doc__) sys.exit(2) ext_dir = sys.argv[1] manifest_path = os.path.join(ext_dir, "manifest.json") with open(manifest_path, "r", encoding="utf-8") as f: manifest = json.load(f) bg = manifest.get("background", {}) findings = [] # MV2-style background page/scripts keys would give background.html # (and whatever it script-tags) a real load path. if "page" in bg: findings.append(f"background.page = {bg['page']!r}") if "scripts" in bg: findings.append(f"background.scripts = {bg['scripts']!r}") # Anything other than exactly the shipped service worker is worth a look. sw = bg.get("service_worker") if sw and sw != "js/background.js": findings.append(f"background.service_worker changed to {sw!r}") if findings: print("Reachable load path found:") for item in findings: print(f" - {item}") sys.exit(1) print("No load path to background.html / js/main.js in this manifest.") print("The redirect and tracking module remains dormant.") sys.exit(0)if __name__ == "__main__": main()- 1Unpack the CRX.
- 2Run: python3 check_redirector_wiring.py <unpacked_dir>.
- 3Exit code 1 means re-check the build for reactivation.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 8.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Schedule its own background tasks
alarms
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Advanced Auto Logout contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.rules.safetyredirector.com
Advanced Auto Logout sends data to www.rules.safetyredirector.com. 4 other extensions we have analyzed send data here.
