Is Apple Music(iTunes) Web Player safe?

Medium risk

Apple Music(iTunes) Web Player sets Chrome searches to chromecrxstore.com and sends omnibox search terms there.

The extension declares a default search provider named Google, but its manifest routes search queries and suggestions to chromecrxstore.com. This applies to search terms entered through Chrome's omnibox and does not show evidence of reading page content.

AdBhuT Extensionsv1.2Chrome Web Store
45Risk
Who publishes it

AdBhuT Extensions - 3 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AdBhuT Extensions

Same store account

3 other listings published from this account, 36k+ users between them. 3 of them carry a finding.

Quick Spotify Search: Instant Music & Podcast Finder20k+MediumAmazon Search Pro: Right-Click, Popup & Omnibox (ALL COUNTRIES!)10k+MediumYouTube Music Web Player Search6k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search terms sent to chromecrxstore.com through default search override

The extension's manifest sets chromecrxstore.com as the default omnibox search provider under the name Google.

Typed search terms go to chromecrxstore.com/query/index.html, and suggestions come from chromecrxstore.com/suggest.php.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

A user enters a browser omnibox search.

The extension did this

The extension sets chromecrxstore.com as the default search provider and forwards omnibox search terms there.

Captured request
GETchromecrxstore.com/query/index.html
Fields in the request
  • Your search terms
    weather tomorrow (illustrative)

    The words typed into the browser omnibox can reveal what you are looking for online.

Where it sends data

Destinations our analysis observed Apple Music(iTunes) Web Player contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromecrxstore.com

    Apple Music(iTunes) Web Player sends data to chromecrxstore.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026lmnnbjniocahgmdmhgpbfdapbelhjnil