Is Bing Homepage, Search & Trending Topics safe?

Medium risk

Bing Homepage, Search & Trending Topics is medium risk. On a fresh install's first activation, the extension calls cookies.getAll({}), retrieving every cookie from every site visited. It scans for eight named cookies; matches copy to storage, then delete from the jar.

Microsoft Corporationv1.0.0.15Chrome Web Store
48Risk
Who publishes it

Microsoft Corporation - 10 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Microsoft Corporation
Declared legal entity
Microsoft Corporation
Registered address
One Microsoft Way, Redmond, WA 98052-8300, US
Registered contact
Microsoft Corporation

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Broad Cookie Scan Reads All Domains on First Enable

On a fresh install's first activation, the extension calls cookies.getAll({}), retrieving every cookie from every site visited.

It scans for eight named cookies; matches copy to storage, then delete from the jar.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the extension and it activates for the first time.

The extension did this

The extension reads every cookie from every site in your browser, searches for eight named installer-metadata cookies, copies matches into its storage, then deletes them.

This fires once, when the pc key is absent from chrome.storage.local, and the extension's description does not mention it.

Cookies the extension searches for across all your sites
  • Installer partner code
    UWDF

    Identifies which software bundle or distribution partner installed this extension on your machine.

  • Machine ID
    EEF42D79F57F4E57AE3C8A2D67332C93

    A unique identifier for your device, set by an associated installer program.

  • Operating system version
    6.2.8400.1

    Your Windows OS version string as recorded by the installer.

  • Install date / time
    2024-03-15 / 10:32:07

    The date and time the companion software was installed on your machine.

  • Market / locale
    en-us

    Your browser locale or regional market code.

  • Package / logger version
    DefaultPack / 1.7.29.0

    Version numbers for the installer package and logging component.

The code that does this

The cookie sweep in ping.js, shipped source alongside deobfuscated reading:

Readable version

Annotated reading of the same block

// Fires once when extension first enables and no installer record (pc) exists.// chrome.cookies.getAll({}) with empty filter = retrieves ALL cookies from ALL domains.chrome.storage.local.get(["pc", "BingDefaultsSet"], (items) => {    if (!items.pc) {        // ← empty filter: no domain, no name — Chrome returns every cookie        chrome.cookies.getAll({}, function (cookies) {            for (var i in cookies) {                // iterates the full cross-domain cookie list                cookieFound = false;                // only these 8 names are acted on; all others are iterated but ignored                if (cookies[i].name == "PCCode") {                    PCCode = cookies[i].value;        // installer partner code                    setStorage("PartnerCode", PCCode); // saved to extension storage                    setStorage("pc", PCCode);                    cookieFound = true;                } else if (cookies[i].name == "MachineID") {                    MachineID = cookies[i].value;     // device ID from installer                    cookieFound = true;                } /* ... OS, InstalledDate, InstalledTime, Market, LoggerVersion, PackageCode */                if (cookieFound) {                    // delete the matched cookie from the browser's jar                    var url = "http" + (cookies[i].secure ? "s" : "") + "://" + cookies[i].domain + cookies[i].path;                    chrome.cookies.remove({ url, name: cookies[i].name });                }            }        });    }});
Why the broad scan matters

The extension only acts on eight specifically named cookies, and the sweep runs just once. However, Chrome's `cookies` permission with an empty `getAll({})` filter makes the entire browser cookie store — session tokens, authentication cookies, preferences — available to the extension's JavaScript at the moment of the call. The cookies that are not named matches are iterated but not copied or deleted. The eight that do match are read into extension storage and deleted from the browser. This behavior is not described in the extension's Chrome Web Store listing.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on g.ceipmsn.com

    http://g.ceipmsn.com/*

  • Read and change your data on bing.com

    http://*.bing.com/* and 1 more

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026nfedoihopcjdfjihhhojdclnfdgomdho