Is Browser-Surf safe?

Medium risk

Browser-Surf replaces the new tab page with a search form that forwards every query to browser-surf.xyz with an affiliate tracking ID.

Each time a user opens a new tab and submits a search, the query text and a fixed affiliate parameter (pid=browsersurfnt) are sent to www.browser-surf.xyz as a GET request. The extension does not perform the search locally or through a browser default; all queries are routed through the extension operator's domain. No other data collection was identified in the source.

Browser-Surfv2.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab searches routed to browser-surf.xyz with affiliate tracking ID

Every new-tab search is submitted as a GET to browser-surf.xyz, not Bing as the store listing claims.

A hidden field appends pid=browsersurfnt so browser-surf.xyz logs the query under its affiliate account before any Bing results return.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You type a search query into the new-tab page and submit the form.

The extension did this

The form sends your query to browser-surf.xyz with an affiliate tracking parameter before returning any results.

The GET request includes q=<your query>&pid=browsersurfnt. The pid value is hardcoded in a non-visible form field and is always included.

The code that does this

Search form with non-visible affiliate tracking field

Readable version
<form id="searchForm" class="search-holder" action="https://www.browser-surf.xyz/chrome/newtab/searchresults.aspx">    <i class="icon-search"></i>    <input type="text" class="input" id="search-term" name="q" placeholder="Search web" autocomplete="off">    <!-- Affiliate tracking parameter — always submitted with every query, not shown in the UI -->    <input type="hidden" id="form-pid" name="pid" value="browsersurfnt">    <input type="submit" class="submit" value=""></form>
Data submitted on every new-tab search
  • Search query
    q=how to reset my password

    The full text of whatever you searched for is sent to browser-surf.xyz's server.

  • Affiliate tracking ID
    pid=browsersurfnt

    A fixed identifier that attributes your searches to the Browser-Surf affiliate account, allowing the publisher to earn revenue per search.

Where your searches go
    • www.browser-surf.xyz

    Receives every new-tab query plus the affiliate parameter. The listing claims Bing is the provider; browser-surf.xyz is the actual first recipient.

Where it sends data

Destinations our analysis observed Browser-Surf contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.browser-surf.xyz

    Browser-Surf sends data to www.browser-surf.xyz. No other extension we have analysed sends data here.

Updated 30 September 2026kjmdpehoiajconemdlnmjiglfonoemkm