Is Amazon Search Pro: Right-Click, Popup & Omnibox (ALL COUNTRIES!) safe?

Medium risk

Amazon Search Pro routes address-bar, popup, omnibox, and selected-text searches through chromecrxstore.com.

The extension sets Chrome's default search provider to chromecrxstore.com, so address-bar searches are sent there. Its popup, omnibox keyword, and right-click Amazon search features also open chromecrxstore.com URLs containing the user's typed query or selected page text.

AdBhuT Extensionsv4.8Chrome Web Store
49Risk
Who publishes it

AdBhuT Extensions - 3 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AdBhuT Extensions

Same store account

3 other listings published from this account, 28k+ users between them. 3 of them carry a finding.

Quick Spotify Search: Instant Music & Podcast Finder20k+MediumYouTube Music Web Player Search6k+MediumApple Music(iTunes) Web Player2k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon search queries are sent to chromecrxstore.com.

When you search from the popup, the amz omnibox keyword, or selected page text via the context menu, the extension sends that query to chromecrxstore.com, in the q parameter of the Amazon search URL.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You start an Amazon search from the popup, omnibox keyword, or context menu.

The extension did this

The extension opens a chromecrxstore.com Amazon search URL containing the query.

Captured request
GETchromecrxstore.com/amazonsearch?q=<query>
Fields in the request
  • Your search text
    wireless headphones (illustrative)

    The words you type in the popup or omnibox are sent as the search query.

  • Selected page text
    replacement charger (illustrative)

    Text selected from the current page can be sent as the context-menu search query.

Address-bar searches route to chromecrxstore.com by default.

When you search from Chrome's address bar, this extension makes chromecrxstore.com the default search provider and sends your search terms there, via the extension's search-provider override, covering history context and typed queries.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user performs an address-bar search.

The extension did this

The extension's default search-provider override routes the query to chromecrxstore.com.

Captured request
GEThttps://chromecrxstore.com/query/index.html?q={searchTerms}
Fields in the request
  • Browsing context
    address-bar search (illustrative)

    The search request reveals that a search was made through the browser's address bar.

  • Search terms
    wireless headphones (illustrative)

    The words you type into the address bar can reveal interests, questions, or intended destinations.

What it can do

Permissions this extension asks for, as declared in version 4.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on suggestqueries.google.com

    https://suggestqueries.google.com/*

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

omnibox

Where it sends data

Destinations our analysis observed Amazon Search Pro: Right-Click, Popup & Omnibox (ALL COUNTRIES!) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromecrxstore.com

    Amazon Search Pro: Right-Click, Popup & Omnibox (ALL COUNTRIES!) sends data to chromecrxstore.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026hloblpeplfiajnfdengendhdnpmdgagn