Is BuxMoney safe?
BuxMoney follows remote tasks that navigate, click, scroll, play media, and inject scripts in its autosurf window.
BuxMoney requests task instructions from bux.money and uses them to drive an extension-controlled browser window, including navigation, clicks, scrolling, media playback, and all-frame script injection. It also reports event markers back to bux.money and deletes browser history entries for URLs loaded in that autosurf window.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
BuxMoney deletes your browser history for every page its autosurf window loads
We observed BuxMoney erase the exact page its autosurf window just visited from your Chrome history, immediately after loading it.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You turn on BuxMoney's autosurf/addon mode, which pays you for pages viewed in a dedicated browser window.
The extension opens that window itself and loads remote ad/task pages into it one after another.
The moment a page finishes loading in that window, BuxMoney deletes it from your Chrome browsing history.
This happens for every HTTP or HTTPS page the autosurf window visits, with no way to opt out.
The tab-update listener that erases each autosurf page from history
chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) { chrome.storage.local.get(["winId"], function (stored) { var autosurfWindowId = stored.winId || undefined; // Only act on tab updates inside the extension's own autosurf window, // and only once the destination URL is known. if (tab.windowId === autosurfWindowId && changeInfo.url) { if (/^(http|https)/i.test(tab.url)) { // Pre-approve popups for the destination origin so the ad/task // page can pop windows without a browser prompt. chrome.contentSettings.popups.set({ primaryPattern: tab.url.match(/^https?:\/\/[^/]+/i)[0] + "/*", setting: "allow", }); } // Mute the tab so autosurf traffic runs silently in the background. chrome.tabs.update(tab.id, { muted: true }); // Delete the just-visited URL from Chrome history. chrome.history.deleteUrl({ url: tab.url }); } });});Top-level navigation inside the extension's own autosurf window; no request body. A planted marker URL was used to prove the page actually loaded before checking whether it survived in Chrome history.
This deletion only fires inside the window BuxMoney creates for autosurf, not your regular tabs. That window can be pointed at any HTTP or HTTPS site, so every page it loads vanishes from your history.
What it can do
Permissions this extension asks for, as declared in version 1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
See the address and title of every tab you have open
tabs
Store data in your browser
storage
Show you desktop notifications
notifications
Read and change your full browsing history
history
Schedule its own background tasks
alarms
Run its own code inside the pages you visit
scripting
Read information about your displays
system.display
Change per-site browser settings such as cookies, JavaScript and camera access
contentSettings
Where it sends data
Destinations our analysis observed BuxMoney contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- bux.money
BuxMoney sends data to bux.money. No other extension we have analysed sends data here.