Is Always Secured powered by Yahoo safe?

Medium risk

Always Secured powered by Yahoo redirects Google and Bing search-result visits to alwayssecuredsearch.com with the query preserved.

When you open matching Google or Bing search-result pages, the extension's declarative network rule redirects the top-level page to Always Secured Search. The redirected URL includes the original search query as a query parameter.

Angel Chasev3.0.3Chrome Web Store
48Risk
Who publishes it

Angel Chase - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Angel Chase
Website
www.alwayssecured.net/contact/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Redirects your Google and Bing searches to alwayssecuredsearch.com

We observed every matching Google or Bing search navigation redirected to alwayssecuredsearch.com, carrying your exact search text into the new URL, with no consent prompt shown first.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You search on Google or Bing.

For example, opening a URL like google.com/search?q=...&sourceid=chrome.

The extension did this

The extension redirects the page to alwayssecuredsearch.com with your exact search text.

The redirect fires automatically on the page navigation, before Google's or Bing's own results load.

Captured request
GEThttps://www.alwayssecuredsearch.com/search/?category=web&s=sppr&vert=private&q=wireless+mouse+reviews

HTTP 307 redirect from a Google search request (https://www.google.com/search?q=wireless+mouse+reviews&sourceid=chrome; query shown is illustrative). Observed during dynamic analysis: a planted test query was carried through unmodified into the redirected URL, confirming the extension preserves the exact search text.

The code that does this

The network rules that intercept Google and Bing searches

Readable version

Bing rule, annotated

rules/search-rules.json
{  "id": 1,  "condition": {    // Matches any bing.com/search?q=...&FORM=... URL    // Capture group 2 is your literal search text    "regexFilter": "(bing.com/search?q=)(YOUR_SEARCH_TEXT)(...)&FORM=(...)",    "resourceTypes": ["main_frame"]   // top-level page loads only  },  "action": {    "type": "redirect",    "redirect": {      // Your search text (group 2) is substituted straight into      // the destination URL's q parameter      "regexSubstitution": "https://www.alwayssecuredsearch.com/search/?category=web&s=sppr&vert=private&q=YOUR_SEARCH_TEXT"    }  }}

Google rule, annotated

rules/search-rules.json
{  "id": 2,  "condition": {    // Matches any google.com/search?q=...&sourceid=... URL    // Capture group 2 is your literal search text    "regexFilter": "(google.com/search?q=)(YOUR_SEARCH_TEXT)(...)&sourceid=(...)",    "resourceTypes": ["main_frame"]   // top-level page loads only  },  "action": {    "type": "redirect",    "redirect": {      // Your search text (group 2) is substituted straight into      // the destination URL's q parameter      "regexSubstitution": "https://www.alwayssecuredsearch.com/search/?category=web&s=sppr&vert=private&q=YOUR_SEARCH_TEXT"    }  }}
What the redirected URL carries
  • Your search text
    wireless mouse reviews

    The exact words you typed into Google or Bing, carried over unmodified.

  • Partner code
    s=sppr

    Marks the traffic as arriving through this extension's search redirect, used for revenue-sharing with the search partner.

  • Result category
    category=web

    Tells alwayssecuredsearch.com which type of results to return.

What it can do

Permissions this extension asks for, as declared in version 3.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Add items to the right-click menu

    contextMenus

Where it sends data

Destinations our analysis observed Always Secured powered by Yahoo contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • sug.alwayssecuredsearch.com

    Always Secured powered by Yahoo sends data to sug.alwayssecuredsearch.com. No other extension we have analysed sends data here.

  • www.alwayssecuredsearch.com

    Always Secured powered by Yahoo sends data to www.alwayssecuredsearch.com. No other extension we have analysed sends data here.

Updated 30 September 2026hogkdeobnpnanehjippjlagdpbaojlfm