Is BestSuggest safe?

Low risk

BestSuggest sends page titles, URLs, headings, and meta keywords to its recommendations API on each completed page load.

BestSuggest runs content scripts on HTTP and HTTPS pages, reads the page title, selected headings, and meta title, keywords, and description, then sends that context with tab details to its recommendations API. The API response can also cause the extension to create inactive grouped tabs using server-supplied recommendation URLs.

BestSuggestv1.2.3Chrome Web Store
22Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

BestSuggest sends your page title, headings, and URL on every visit

On every page you load, BestSuggest reads the title, headings, and meta text and sends them, with the page URL, to its own server.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any website in a normal browsing tab.

No search or interaction with the extension is required.

The extension did this

BestSuggest reads the page's title, headings, and meta tags and sends them to its recommendations server.

This runs on every completed page load across HTTP and HTTPS sites, regardless of what the site is.

What's sent from every page you visit
  • Page address
    https://shoptiques.com/products/lior-shoulder-crossbody-backpack-with-usb-cable

    The page URL, with phone/email/password/zip-like query values stripped, letting BestSuggest rebuild your browsing history.

  • Page title
    Lior Shoulder Crossbody Backpack with USB Cable - Shoptiques

    The page's title text, giving BestSuggest a readable label for what you're viewing.

  • Headings & meta text
    h1: Lior Shoulder Crossbody Backpack with USB Cable; h2: Product Details, Shipping & Returns, You May Also Like

    Every H1/H2 heading and the meta title, description, and keywords tags, scraped straight from the page.

  • Guessed search term
    crossbody backpack

    A single keyword phrase BestSuggest extracts from the page content and sends as your implied search query.

  • Device & tab identifiers
    client.id: c8f3a1e2-9b4d-4a11-8c2f-501e6b7d8a90; tab.id: 481; window tabs: 6

    A persistent client ID plus tab, window, and tab-group counts that let BestSuggest link every page you load back to the same browser.

Why you can't catch this in DevTools

The scraped title, headings, and meta text are JSON-encoded and base64-wrapped inside page.context before the request is sent.

Decoded value
{  "searchKeywords": [    "crossbody backpack"  ],  "title": "Lior Shoulder Crossbody Backpack with USB Cable - Shoptiques",  "h1": [    "Lior Shoulder Crossbody Backpack with USB Cable"  ],  "h2": [    "Product Details",    "Shipping & Returns",    "You May Also Like"  ],  "meta": {    "title": "Lior Shoulder Crossbody Backpack with USB Cable",    "keywords": null,    "description": "Shop the Lior Shoulder Crossbody Backpack with built-in USB charging port at Shoptiques."  }}
Captured request
POSThttps://api.bestsuggest.me/recommendations

200 OK, JSON array of recommended articles/products for the current page

Headers
Content-Type
application/json
Body
{  "client": {    "id": "c8f3a1e2-9b4d-4a11-8c2f-501e6b7d8a90"  },  "extension": {    "guid": "bbeoagdpiieajlcdebogffjjlfdgchni",    "version": "1.2.3",    "ticket": "t_4f1a9c2e8b3d4a11"  },  "preferences": {    "snoozed": false,    "sponsored": true  },  "page": {    "url": "https://shoptiques.com/products/lior-shoulder-crossbody-backpack-with-usb-cable",    "title": "Lior Shoulder Crossbody Backpack with USB Cable - Shoptiques",    "searchQuery": "crossbody backpack",    "context": "eyJzZWFyY2hLZXl3b3JkcyI6IFsiY3Jvc3Nib2R5IGJhY2twYWNrIl0sIC4uLn0=",    "group": {},    "tab": {      "id": 481,      "parentId": 479,      "containerId": 9021,      "focused": true,      "fullScreen": false,      "playerResultsTab": false    },    "container": {      "id": 9021,      "type": "normal",      "numberOfTabs": 6    },    "meta": {      "name": null    }  }}
Where the data goes
    • api.bestsuggest.me

    Runs BestSuggest's recommendation, telemetry, and engagement backend; receives this data from every page you load.

What it can do

Permissions this extension asks for, as declared in version 1.2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Read and change your tab groups

    tabGroups

Where it sends data

Destinations our analysis observed BestSuggest contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.bestsuggest.me

    BestSuggest sends data to api.bestsuggest.me. No other extension we have analysed sends data here.

Updated 21 September 2026bbeoagdpiieajlcdebogffjjlfdgchni