Is Bing Homepage, Search & Trending Topics safe?
Bing Homepage, Search & Trending Topics is medium risk. On a fresh install's first activation, the extension calls cookies.getAll({}), retrieving every cookie from every site visited. It scans for eight named cookies; matches copy to storage, then delete from the jar.
Who publishes itMicrosoft Corporation - 10 other listings from the same operator, 3 of them carrying a finding
Microsoft Corporation - 10 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 4.4M+ users between them. 3 of them carry a finding.
Same operator - 3 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Broad Cookie Scan Reads All Domains on First Enable
On a fresh install's first activation, the extension calls cookies.getAll({}), retrieving every cookie from every site visited.
It scans for eight named cookies; matches copy to storage, then delete from the jar.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install the extension and it activates for the first time.
The extension reads every cookie from every site in your browser, searches for eight named installer-metadata cookies, copies matches into its storage, then deletes them.
This fires once, when the pc key is absent from chrome.storage.local, and the extension's description does not mention it.
- Installer partner codeUWDF
Identifies which software bundle or distribution partner installed this extension on your machine.
- Machine IDEEF42D79F57F4E57AE3C8A2D67332C93
A unique identifier for your device, set by an associated installer program.
- Operating system version6.2.8400.1
Your Windows OS version string as recorded by the installer.
- Install date / time2024-03-15 / 10:32:07
The date and time the companion software was installed on your machine.
- Market / localeen-us
Your browser locale or regional market code.
- Package / logger versionDefaultPack / 1.7.29.0
Version numbers for the installer package and logging component.
The cookie sweep in ping.js, shipped source alongside deobfuscated reading:
Annotated reading of the same block
// Fires once when extension first enables and no installer record (pc) exists.// chrome.cookies.getAll({}) with empty filter = retrieves ALL cookies from ALL domains.chrome.storage.local.get(["pc", "BingDefaultsSet"], (items) => { if (!items.pc) { // ← empty filter: no domain, no name — Chrome returns every cookie chrome.cookies.getAll({}, function (cookies) { for (var i in cookies) { // iterates the full cross-domain cookie list cookieFound = false; // only these 8 names are acted on; all others are iterated but ignored if (cookies[i].name == "PCCode") { PCCode = cookies[i].value; // installer partner code setStorage("PartnerCode", PCCode); // saved to extension storage setStorage("pc", PCCode); cookieFound = true; } else if (cookies[i].name == "MachineID") { MachineID = cookies[i].value; // device ID from installer cookieFound = true; } /* ... OS, InstalledDate, InstalledTime, Market, LoggerVersion, PackageCode */ if (cookieFound) { // delete the matched cookie from the browser's jar var url = "http" + (cookies[i].secure ? "s" : "") + "://" + cookies[i].domain + cookies[i].path; chrome.cookies.remove({ url, name: cookies[i].name }); } } }); }});The extension only acts on eight specifically named cookies, and the sweep runs just once. However, Chrome's `cookies` permission with an empty `getAll({})` filter makes the entire browser cookie store — session tokens, authentication cookies, preferences — available to the extension's JavaScript at the moment of the call. The cookies that are not named matches are iterated but not copied or deleted. The eight that do match are read into extension storage and deleted from the browser. This behavior is not described in the extension's Chrome Web Store listing.
What it can do
Permissions this extension asks for, as declared in version 1.0.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on g.ceipmsn.com
http://g.ceipmsn.com/*
Read and change your data on bing.com
http://*.bing.com/* and 1 more
Read and change cookies, including the ones that keep you signed in
cookies
See, disable and uninstall your other extensions, including your security ones
management
Store data in your browser
storage
Schedule its own background tasks
alarms
Run its own code inside the pages you visit
scripting