Is After Dark Mode safe?
After Dark Mode is medium risk. Installing or updating this extension auto-opens a tab to afterdarkmode.com with your extension runtime ID and version: /installed.php?extid=...&version=1.0.1&reason=install, no consent prompt or listing disclosure.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Install Beacon Sends Extension ID and Version to Developer Server
Installing or updating this extension auto-opens a tab to afterdarkmode.com with your extension runtime ID and version: /installed.php?extid=...&version=1.0.1&reason=install, no consent prompt or listing disclosure.
You install or update the After Dark Mode extension.
The extension opens a new browser tab to afterdarkmode.com, passing your extension runtime ID and the current version number in the URL.
The tab navigation is visible, but the URL parameters transmitting your extension ID and version are not explained to you.
| Field | Value | Why it matters | |
|---|---|---|---|
Extension runtime ID | oldjdmjhcjmkfhpakbjhcjlonadpooge | A browser-assigned identifier unique to your install of this extension, letting the developer identify your specific browser. | |
Extension version | 1.0.1 | The version of the extension you have installed. | |
Install reason | install | Whether this is a fresh install or an update. Sent on every version change. |
Install beacon code in background.js
chrome.runtime.onInstalled.addListener(function (details) {
let now = Date.now() / 1000;
let version = chrome.runtime.getManifest().version;
let url = '';
if (details.reason === "install" || details.reason === "update") {
chrome.storage.sync.set({
'installed_at' : now
}, function() {});
url = service_host+'/installed.php?extid=' + encodeURIComponent(chrome.runtime.id) +
'&version='+encodeURIComponent(version)+
'&reason='+encodeURIComponent(details.reason);
chrome.tabs.create({ url: url });
}
});- afterdarkmode.com
Developer-operated server. Receives extension runtime ID, version, and install reason on every install or update event.
Server-Assigned Tracking ID Appended to Every Search Query
After install, afterdarkmode.com sends a unique tracking ID.
The extension updates a network rule so searches via its overridden engine include it as 'f='.
DA captured the rule set to '6a2345b155909', no consent prompt.
You install the extension and the developer's website opens in a new tab.
The developer's website sends a unique tracking ID to the extension, which the extension stores and embeds in every subsequent search query URL.
The tracking ID persists in browser storage and is re-applied to every search without any further user interaction.
The tracking ID from the developer's server, applied to searches via declarativeNetRequest rules. Persists across sessions.
chrome.storage.local key 'id'{"id": "6a2345b155909"}| Field | Value | Why it matters | |
|---|---|---|---|
Affiliate / tracking ID | 6a2345b155909 | A server-assigned ID linking your searches to your browser install, sent with every search via the overridden engine. |
Tracking ID injection via declarativeNetRequest
chrome.runtime.onMessageExternal.addListener(function(request, sender, sendResponse) {
if (sender.origin === service_host && request.id) {
chrome.storage.local.set({ 'id': request.id }, function(){
updateRules(request.id);
});
}
});
function updateRules(id) {
fetch(chrome.runtime.getURL('rules.json'))
.then(response => {
return response.json();
})
.then(d => {
d.addRules[0].action.redirect.transform.queryTransform.addOrReplaceParams[0].value = id;
chrome.declarativeNetRequest.updateDynamicRules(d);
});
}- afterdarkmode.com
Developer-operated server. Assigns the per-user tracking ID to the extension via the externally_connectable message channel.
- ezafterdark.com
Search redirect target. The declarativeNetRequest rule appends the tracking ID as f=<id> to navigations matching ^https://ezafterdark.com/serp.php.
What it can do
Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on afterdarkmode.com
https://afterdarkmode.com/*
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest