Is Android emulator MyAndroid safe?
Android emulator MyAndroid reports every website you visit to its own server, once per day, keyed to a persistent per-install ID.
The extension watches every page you navigate to across the entire web and, throttled to about once a day, sends the current and previous page URLs — hex-encoded, tagged with a persistent random ID generated on install — to the developer's own backend. Separately, any time a page's URL ends in .apk or .apkx it sends that full URL to a second endpoint on the same domain with no daily limit. Both reports can trigger the extension to auto-open a new tab on the developer's site.
Who publishes itMyAndroid - no other listings under this identity, 1 shared hostname
MyAndroid - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
MyAndroid emulator extension sends your browsing history to its own backend
Code analysis shows this extension records every website you visit and, about once a day, sends your current and previous page URLs to the developer's own server along with a persistent per-install ID.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You navigate from one ordinary website to another in the same browser tab.
This fires on virtually any top-level navigation, not just specific sites the extension needs to watch.
The extension records both the page you just left and the page you landed on, then, on a daily schedule, sends that pair to its own server.
The listener is registered for any URL whose host contains a period, which matches nearly the entire web.
- The page you're currently onhttps://example.com/checkout/step-2
The full address of the site you just navigated to, including path and query string.
- The page you came fromhttps://example.org/search?q=android+emulator
The full address of the previous site in the same tab, letting the vendor reconstruct your browsing path.
- Your install IDk3j9dqxz2m
A random ID generated once at install and reused every time, so the vendor can link all your visits together over time.
The URL pair is hex-encoded before it's placed in the request, so it doesn't read as a plain URL at a glance.
https://example.com/checkout/step-2|||https://example.org/search?q=android+emulatorThe navigation listener and the daily-throttled report function
In plain terms
// On every top-level navigation to a URL whose host contains a dot:// 1. Look up the previous URL for this tab from storage.// 2. Pass currentURL + '|||' + previousURL to the report function.// 3. Save the current URL as the new 'previous' for this tab.// The report function only proceeds once per calendar day (heldd()).// It reads or creates a persistent per-install ID from storage,// hex-encodes the URL pair, and sends it as a query parameter to// the developer's own backend. If the server replies 'OKOKOK',// a new tab is opened pointing back at the developer's site.- www.myandroid.org
Receives your current and previous page URLs (hex-encoded) plus your persistent install ID, roughly once per day. The extension developer's own domain.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Read and change your data on every site you visit
http://*/*
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Android emulator MyAndroid contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.myandroid.org
Android emulator MyAndroid sends data to www.myandroid.org. One other extension we have analyzed sends data here.