Is Bing Homepage, Search & Trending Topics safe?

Medium risk

Bing Homepage, Search & Trending Topics is medium risk. On a fresh install's first activation, the extension calls cookies.getAll({}), retrieving every cookie from every site visited. It scans for eight named cookies; matches copy to storage, then delete from the jar.

Microsoft Corporationv1.0.0.15Chrome Web Store
45Risk
Who publishes it

Microsoft Corporation - 10 other listings from the same operator, 4 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Microsoft Corporation
Declared legal entity
Microsoft Corporation
Registered address
One Microsoft Way, Redmond, WA 98052-8300, US
Registered contact
Microsoft Corporation

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Broad Cookie Scan Reads All Domains on First Enable

On a fresh install's first activation, the extension calls cookies.getAll({}), retrieving every cookie from every site visited.

It scans for eight named cookies; matches copy to storage, then delete from the jar.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension and it activates for the first time.

The extension did this

The extension reads every cookie from every site in your browser, searches for eight named installer-metadata cookies, copies matches into its storage, then deletes them.

This fires once, when the pc key is absent from chrome.storage.local, and the extension's description does not mention it.

02EvidenceFIELD TABLE
Cookies the extension searches for across all your sites:
FieldValueWhy it matters
Installer partner code
UWDFIdentifies which software bundle or distribution partner installed this extension on your machine.
Machine ID
EEF42D79F57F4E57AE3C8A2D67332C93A unique identifier for your device, set by an associated installer program.
Operating system version
6.2.8400.1Your Windows OS version string as recorded by the installer.
Install date / time
2024-03-15 / 10:32:07The date and time the companion software was installed on your machine.
Market / locale
en-usYour browser locale or regional market code.
Package / logger version
DefaultPack / 1.7.29.0Version numbers for the installer package and logging component.
03EvidenceCODE COMPARE
The code that does this

The cookie sweep in ping.js, shipped source alongside deobfuscated reading:

What it actually does
Annotated reading of the same block
// Fires once when extension first enables and no installer record (pc) exists.
// chrome.cookies.getAll({}) with empty filter = retrieves ALL cookies from ALL domains.
chrome.storage.local.get(["pc", "BingDefaultsSet"], (items) => {
    if (!items.pc) {
        // ← empty filter: no domain, no name — Chrome returns every cookie
        chrome.cookies.getAll({}, function (cookies) {
            for (var i in cookies) {
                // iterates the full cross-domain cookie list
                cookieFound = false;
                // only these 8 names are acted on; all others are iterated but ignored
                if (cookies[i].name == "PCCode") {
                    PCCode = cookies[i].value;        // installer partner code
                    setStorage("PartnerCode", PCCode); // saved to extension storage
                    setStorage("pc", PCCode);
                    cookieFound = true;
                } else if (cookies[i].name == "MachineID") {
                    MachineID = cookies[i].value;     // device ID from installer
                    cookieFound = true;
                } /* ... OS, InstalledDate, InstalledTime, Market, LoggerVersion, PackageCode */

                if (cookieFound) {
                    // delete the matched cookie from the browser's jar
                    var url = "http" + (cookies[i].secure ? "s" : "") + "://" + cookies[i].domain + cookies[i].path;
                    chrome.cookies.remove({ url, name: cookies[i].name });
                }
            }
        });
    }
});
04EvidencePLAIN NOTE
Why the broad scan matters

The extension only acts on eight specifically named cookies, and the sweep runs just once. However, Chrome's `cookies` permission with an empty `getAll({})` filter makes the entire browser cookie store — session tokens, authentication cookies, preferences — available to the extension's JavaScript at the moment of the call. The cookies that are not named matches are iterated but not copied or deleted. The eight that do match are read into extension storage and deleted from the browser. This behavior is not described in the extension's Chrome Web Store listing.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on g.ceipmsn.com

    http://g.ceipmsn.com/*

  • Read and change your data on bing.com

    http://*.bing.com/* and 1 more

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026nfedoihopcjdfjihhhojdclnfdgomdho