Is Automate Your Bing Searches safe?
Automate Your Bing Searches is medium risk. Starting a Bing Rewards run replaces your User-Agent with a fabricated mobile string for every site you visit, not just Bing, for the run's duration. DA captured this rule added and removed five times in one session.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
User-agent spoofed to mobile device for all navigation during Bing Reward runs
Starting a Bing Rewards run replaces your User-Agent with a fabricated mobile string for every site you visit, not just Bing, for the run's duration.
DA captured this rule added and removed five times in one session.
You click Start in the extension popup to begin an automated Bing Rewards session.
The popup sends a 'start' message to the background service worker with the search count and mobile-search count parameters.
The extension installs a declarativeNetRequest rule that overwrites the User-Agent header on every navigation to any website for the remainder of the run.
The rule applies to main_frame and sub_frame resource types with urlFilter '*://*/*', so it is not limited to bing.com.
declarativeNetRequest rule installed by performMobileSearch()
function performMobileSearch() {
chrome.declarativeNetRequest.updateDynamicRules(
{
addRules: [
{
"id": 1000,
"priority": 1,
"action": {
"type": "modifyHeaders",
"requestHeaders": [
{
"header": "user-agent",
"operation": "set",
"value": useragent // pre-generated random mobile UA
}
]
},
"condition": {
"urlFilter": "*://*/*", // ALL URLs, not just bing.com
"resourceTypes": [
"main_frame",
"sub_frame"
]
}
}
],
removeRuleIds: [1000]
}, function() {
if (chrome.runtime.lastError) {
chrome.storage.sync.set({ "failedMobile": true });
}
});
// 30ms timeout then navigates to Bing
setTimeout(function() {
chrome.tabs.update(tabId, { "url": "https://www.bing.com/search?q=" + words[...] });
}, 30);
}generateUserAgent(), mobile UA pool sampled at extension load
function generateUserAgent() {
const user_agents = [
`Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 EdgiOS/44.5.0.10 Mobile/15E148 Safari/604.1`,
`Mozilla/5.0 (iPhone; CPU iPhone OS 16_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS.108.0.1462.77 Version/16.0 Mobile/15E148 Safari/604.1`,
`Mozilla/5.0 (Linux; Android 8.1.0; Pixel Build/OPM4.171019.021.D1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36 EdgA/42.0.0.2057`,
`Mozilla/5.0 (Windows Mobile 10; Android 10.0; Microsoft; Lumia 950XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Edge/40.15254.603`,
`Mozilla/5.0 (Linux; Android 10; HD1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.117 Mobile Safari/537.36 EdgA/109.0.1518.53`,
// ... 4 more mobile UA strings
];
const randomIndex = Math.floor(Math.random() * user_agents.length);
return user_agents[randomIndex]; // one UA chosen at load time, reused for the whole run
}| Field | Value | Why it matters | |
|---|---|---|---|
Header overwritten | User-Agent: Mozilla/5.0 (Linux; Android 10; HD1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.117 Mobile Safari/537.36 EdgA/109.0.1518.53 | The User-Agent request header is replaced on every page you navigate to while a search run is active. | |
Affected URL scope | *://*/* | The rule condition covers all URLs, not just Bing. Any site you visit in the same browser during the run receives the spoofed header. | |
Spoofed device type | iPhone; CPU iPhone OS 16_3 like Mac OS X | Websites see your browser as an iPhone, Android phone, or Windows Phone rather than your actual desktop. |
What it can do
Permissions this extension asks for, as declared in version 1.2.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on bing.com
https://*.bing.com/*
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
Schedule its own background tasks
alarms