Is Apple TV Search safe?

Medium risk

Apple TV Search replaces Chrome's default search provider and sends address-bar searches to chromecrxstore.com.

On install, the manifest sets a default search provider (keyword 'google') pointing to chromecrxstore.com for both search queries and suggestions. Every term typed in the address bar is therefore sent to that domain. The extension's stated purpose is an 'ats' omnibox keyword for Apple TV program search, which does not require this change.

AdBhuT Extensionsv1.1.0Chrome Web Store
49Risk
Who publishes it

AdBhuT Extensions - 7 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AdBhuT Extensions

Same store account

7 other listings published from this account, 38k+ users between them. 6 of them carry a finding.

Quick Spotify Search: Instant Music & Podcast Finder20k+MediumAmazon Search Pro: Right-Click, Popup & Omnibox (ALL COUNTRIES!)10k+MediumYouTube Music Web Player Search6k+MediumApple Music(iTunes) Web Player2k+MediumSpotify Web Player Search20MediumPrivate Search Online — Auto History Wipe13Low1 more listing in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Apple TV Search sets Chrome's default search provider to chromecrxstore.com

Code analysis shows the manifest declares chromecrxstore.com as the default search provider, so address-bar searches and suggestions go there.

The Apple TV omnibox feature does not need this.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You search from Chrome's address bar after installing an Apple TV program search extension.

No click on the extension is needed.

The extension did this

Chrome sends the typed text to chromecrxstore.com instead of your previous default search provider.

The code that does this

The manifest search override beside the extension's stated omnibox feature

Readable version

Stated purpose: omnibox keyword 'ats' opens a results page

background.js
chrome.omnibox.onInputEntered.addListener(  function(text) {    let newURL = 'https://chromecrxstore.com/appletvsearch?q=' + encodeURIComponent(text) + '&src=omnibox';    chrome.tabs.create({ url: newURL });  });
Values the default search provider setting sends to chromecrxstore.com
  • Search request URL
    https://chromecrxstore.com/query/index.html?q=bank+login

    Carries each term you type into the address bar.

  • Suggestion request URL
    https://chromecrxstore.com/suggest.php?q=bank+lo

    Receives partial text as you type, before you submit.

  • Provider keyword
    google

    Set to 'google', so the provider is labelled like the usual default.

Hosts named in the search provider setting
    • chromecrxstore.com

    Receives search and suggestion queries, and serves the provider icon.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Apple TV Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromecrxstore.com

    Apple TV Search sends data to chromecrxstore.com. 13 other extensions we have analysed send data here.

Updated 15 October 2026hokakdgbmdcmicbhfhiiiimajefpnbon