Is Bee Hive safe?

Medium risk

BeeHive is medium risk. When you use the Bee Hive new-tab search, the extension submits it to search.beehivetab.com with extra fields added to the URL: search context plus stored values including a persistent user UUID, install token, and affiliate click ID.…

extbeehivev4.0.9Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

New-tab searches send query URLs with persistent identifiers.

When you use the Bee Hive new-tab search, the extension submits it to search.beehivetab.com with extra fields added to the URL: search context plus stored values including a persistent user UUID, install token, and affiliate click ID.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user submits a search from the extension's new-tab page.

The extension did this

The extension submits the search request with stored user and affiliate identifiers appended as form fields.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://search.beehivetab.com/5b6ea6d7-8df4-4d89-93be-c7031d939fbf
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Your search URL
https://search.beehivetab.com/?q=weather (illustrative)The request carries the search URL context submitted from the new-tab page.
Stored extension identifiers
userId=d7f3a1b2-...&utm_uid=affiliate-click-id (illustrative)Values from storage that link searches to one installation: a persistent user UUID, install token, affiliate click ID, and install timing.
SeverityLOW
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Install beacon sends a generated user ID to the extension's vendor

On first install, the worker generates a random UUID and POSTs it to beehivetab.com with your browser name and two identifier values.

Dynamic analysis observed the real UUID sent.

The code reads the response for an auth token and click ID.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user installs the Bee Hive extension for the first time.

The extension did this

The extension generates a random installation ID and sends it, along with the browser name and two fixed identifiers, to the vendor's server in a POST request.

This happens automatically on install, before any other interaction with the extension.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://beehivetab.com/ch/install.php
The server returned an error status during this test session, so no response payload was captured.
Body
{
  "uid": "a51c97d2-ba8b-4a45-9c15-33def9803b1b",
  "b": "chrome",
  "extension": "BeeHiveTabCh",
  "theme_index": 7
}
03EvidenceFIELD TABLE
Fields in the install request
FieldValueWhy it matters
Generated installation ID
a51c97d2-ba8b-4a45-9c15-33def9803b1bA random UUID created at install, sent to the vendor and reused on later requests to link them to this installation.
Browser name
chromeIdentifies which browser the extension is running in.
Extension identifier
BeeHiveTabChA fixed, vendor-assigned label for this build and distribution channel.
Theme index
7A fixed numeric code identifying the install variant.
04EvidencePLAIN NOTE
What this test session did and didn't capture

The install request itself, including the generated UUID, was captured in full during dynamic analysis. The vendor's server returned an error status in this session, so we could not directly observe what it sends back. The extension's source code shows it reads the response body for an authentication token and an affiliate click ID, then writes both to local storage next to the installation UUID.

Updated 17 September 2026gpgjaoiopnickdhpapgglbckmbemeicg