Is After Dark Mode safe?

Medium risk

After Dark Mode is medium risk. Installing or updating this extension auto-opens a tab to afterdarkmode.com with your extension runtime ID and version: /installed.php?extid=...&version=1.0.1&reason=install, no consent prompt or listing disclosure.…

After Darkv1.0.1Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Install Beacon Sends Extension ID and Version to Developer Server

Installing or updating this extension auto-opens a tab to afterdarkmode.com with your extension runtime ID and version: /installed.php?extid=...&version=1.0.1&reason=install, no consent prompt or listing disclosure.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the After Dark Mode extension.

The extension did this

The extension opens a new browser tab to afterdarkmode.com, passing your extension runtime ID and the current version number in the URL.

The tab navigation is visible, but the URL parameters transmitting your extension ID and version are not explained to you.

Captured request
GEThttps://afterdarkmode.com/installed.php?extid=oldjdmjhcjmkfhpakbjhcjlonadpooge&version=1.0.1&reason=install

afterdarkmode.com loaded its 'Thank you for installing' page.

Parameters sent in the install beacon URL
  • Extension runtime ID
    oldjdmjhcjmkfhpakbjhcjlonadpooge

    A browser-assigned identifier unique to your install of this extension, letting the developer identify your specific browser.

  • Extension version
    1.0.1

    The version of the extension you have installed.

  • Install reason
    install

    Whether this is a fresh install or an update. Sent on every version change.

The code that does this

Install beacon code in background.js

Readable version
chrome.runtime.onInstalled.addListener(function (details) {    let now = Date.now() / 1000;    let version = chrome.runtime.getManifest().version;    let url = '';    if (details.reason === "install" || details.reason === "update") {        chrome.storage.sync.set({            'installed_at' : now        }, function() {});        url = service_host+'/installed.php?extid=' + encodeURIComponent(chrome.runtime.id) +            '&version='+encodeURIComponent(version)+            '&reason='+encodeURIComponent(details.reason);        chrome.tabs.create({ url: url });    }});
Server that receives the install beacon
    • afterdarkmode.com

    Developer-operated server. Receives extension runtime ID, version, and install reason on every install or update event.

Server-Assigned Tracking ID Appended to Every Search Query

After install, afterdarkmode.com sends a unique tracking ID.

The extension updates a network rule so searches via its overridden engine include it as 'f='.

DA captured the rule set to '6a2345b155909', no consent prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the extension and the developer's website opens in a new tab.

The extension did this

The developer's website sends a unique tracking ID to the extension, which the extension stores and embeds in every subsequent search query URL.

The tracking ID persists in browser storage and is re-applied to every search without any further user interaction.

What's stored on your device

The tracking ID from the developer's server, applied to searches via declarativeNetRequest rules. Persists across sessions.

Location
chrome.storage.local key 'id'
Contents
{  "id": "6a2345b155909"}
Tracking parameter appended to search queries
  • Affiliate / tracking ID
    6a2345b155909

    A server-assigned ID linking your searches to your browser install, sent with every search via the overridden engine.

The code that does this

Tracking ID injection via declarativeNetRequest

Readable version
chrome.runtime.onMessageExternal.addListener(function(request, sender, sendResponse) {    if (sender.origin === service_host && request.id) {        chrome.storage.local.set({ 'id': request.id }, function(){            updateRules(request.id);        });    }});function updateRules(id) {    fetch(chrome.runtime.getURL('rules.json'))        .then(response => {            return response.json();        })        .then(d => {            d.addRules[0].action.redirect.transform.queryTransform.addOrReplaceParams[0].value = id;            chrome.declarativeNetRequest.updateDynamicRules(d);        });}
Domains involved in the tracking pipeline
    • afterdarkmode.com

    Developer-operated server. Assigns the per-user tracking ID to the extension via the externally_connectable message channel.

    • ezafterdark.com

    Search redirect target. The declarativeNetRequest rule appends the tracking ID as f=<id> to navigations matching ^https://ezafterdark.com/serp.php.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on afterdarkmode.com

    https://afterdarkmode.com/*

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026ogeojedmbbkegmemndbinckochofelkh