Is Advanced Auto Logout safe?
Advanced Auto Logout ships a dormant tab-redirect module branded ‘Safety Redirector’ that isn't wired into this build's manifest.
The extension's files include a full navigation-monitoring system, called Safety Redirector, that checks every URL you visit against a rule list fetched from a remote server and would redirect the tab when a rule matches. It also generates a persistent random ID on install and would send it, along with a running counter, to the same server once a day. As shipped in version 8.0.2, this code lives in a background page that Chrome's Manifest V3 configuration never loads, so none of it currently runs.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Advanced Auto Logout ships a dormant browser-redirect and tracking module
Code analysis found a complete redirect and tracking module bundled in this build, but manifest.json never loads it, so it does not run in version 8.0.2.
If reconnected, it can redirect any page you visit without asking.
You install this build and browse to any webpage.
Bundled code would check the page against a remote rule list and could redirect your tab without asking, but manifest.json never loads that code in this build.
What the manifest wires vs. what the package ships
<html> <body> <script type="text/javascript" src="/js/main.js"></script> <script type="text/javascript" src="/js/Logout.js"></script> <script type="text/javascript" src="/js/Options_logout.js"></script> <script type="text/javascript" src="/js/background.js"></script> </body> </html>
chrome.webNavigation.onBeforeNavigate.addListener(function(tab) {
ruleExists(tab, tab.url);
});
// ...
xhr.open('GET', 'http://www.rules.safetyredirector.com/url_redirect3.php', true);
xhr.send();
// ...
var newUrl = (/^https?:\/\//.test(rule[0]) ? '' : 'http://') + rule[0];
chrome.tabs.update(tab.tabId, { url: newUrl });| Field | Value | Why it matters | |
|---|---|---|---|
Rule list fetch | GET http://www.rules.safetyredirector.com/url_redirect3.php | The code loads a block/redirect rule list from the developer's own server before checking your page. | |
Redirect destination | http://example-affiliate.example/landing (illustrative; the real value comes from the remote rule list, not the code) | On a rule match, your tab is sent to whatever URL that rule contains, with no confirmation dialog. | |
Device identifier | K7pQz2XvB9nR4mLt8sYcW1oAeUiHfDg2 (illustrative; the code generates 255 random characters, shown shortened here) | A random identifier is generated once at install and reused in every daily report. | |
Daily report | POST http://www.rules.safetyredirector.com/track.php body: user_id=K7pQz2Xv...&malware=3&typos=0 | The device identifier and a running count of redirects are posted together, once per day, over plain HTTP. |
Checks an unpacked extension's manifest.json for whether the redirect module has a real load path, versus this dormant build.
#!/usr/bin/env python3
"""
check_redirector_wiring.py
Checks whether an unpacked copy of this extension has re-wired the
bundled 'Safety Redirector' redirect/tracking module. In version 8.0.2
the module (pages/background.html -> js/main.js) ships but is never
loaded, because Manifest V3 has no background 'page'/'html' key.
Usage:
python3 check_redirector_wiring.py /path/to/unpacked_extension
Exit code 0: no reachable load path found (module still dormant).
Exit code 1: a load path was found (module may be reachable).
"""
import json
import os
import sys
def main():
if len(sys.argv) != 2:
print(__doc__)
sys.exit(2)
ext_dir = sys.argv[1]
manifest_path = os.path.join(ext_dir, "manifest.json")
with open(manifest_path, "r", encoding="utf-8") as f:
manifest = json.load(f)
bg = manifest.get("background", {})
findings = []
# MV2-style background page/scripts keys would give background.html
# (and whatever it script-tags) a real load path.
if "page" in bg:
findings.append(f"background.page = {bg['page']!r}")
if "scripts" in bg:
findings.append(f"background.scripts = {bg['scripts']!r}")
# Anything other than exactly the shipped service worker is worth a look.
sw = bg.get("service_worker")
if sw and sw != "js/background.js":
findings.append(f"background.service_worker changed to {sw!r}")
if findings:
print("Reachable load path found:")
for item in findings:
print(f" - {item}")
sys.exit(1)
print("No load path to background.html / js/main.js in this manifest.")
print("The redirect and tracking module remains dormant.")
sys.exit(0)
if __name__ == "__main__":
main()
- 1Unpack the CRX.
- 2Run: python3 check_redirector_wiring.py <unpacked_dir>.
- 3Exit code 1 means re-check the build for reactivation.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.