Is Change Default Search Engine safe?
Change Default Search Engine routes browser search terms through default-search.site and sends ad events with a persistent client ID.
The extension overrides browser search settings so typed search terms go to default-search.site before being redirected to the selected search provider. Its popup ad module also sends banner impression and click events to ext-ads-mvp.captain-products.workers.dev with a banner ID, timestamp, and persistent client ID stored in localStorage.
Who publishes itjeff38399green - 1 other listing from the same operator, none carrying a finding
jeff38399green - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 2k+ users between them, none of them carrying a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Change Default Search Engine routes every search through its own domain first
Every search you type goes to default-search.site, a domain this extension controls, before you're forwarded to Google, Bing, or Yahoo.
Dynamic analysis confirmed the search term travels through that domain unchanged.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You type a search term into the browser address bar.
This extension registers itself as the browser's default search provider on install.
The browser sends your search to default-search.site instead of directly to your chosen search engine.
A second redirect then forwards you on to Google, Bing, or Yahoo with the search term still in the URL.
Observed redirect chain: default-search.site/search/?os=t&q=... (307) to default-search.site/search/google/?q=... (302) to www.google.com/search?q=... (200). A planted marker search term was used during dynamic analysis and was confirmed present on both default-search.site hops before the final redirect to Google. The query text shown here is illustrative.
- Google (default)https://default-search.site/search/google/?q=wireless+headphones+reviews
Routed through default-search.site before reaching Google, so the extension's configured domain sees the query first.
- Binghttps://default-search.site/search/bing/?q=wireless+headphones+reviews
Same routing through default-search.site before reaching Bing.
- Yahoohttps://default-search.site/search/yahoo/?q=wireless+headphones+reviews
Same routing through default-search.site before reaching Yahoo.
- Yandex, Baidu, Askhttps://www.yandex.ru/search/?text=wireless+headphones+reviews
These three providers are not routed through default-search.site; the extension sends the query straight to them.
- default-search.site
Configured in the extension's manifest as the search provider; receives your search term before redirecting you to Google, Bing, or Yahoo.
Sends a search query directly to the URL this extension always redirects you to, showing that default-search.site's own server sees your search term before forwarding you to Google.
- curl
- python3
#!/bin/sh# Usage: ./verify-search-redirect.sh "your search terms"Q="${1:-wireless headphones reviews}"ENC=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))" "$Q")curl -sS -D - -o /dev/null "https://default-search.site/search/google/?q=$ENC" | grep -i "^location\|^HTTP"- 1Save as verify-search-redirect.sh.
- 2Run: sh verify-search-redirect.sh "your terms".
- 3The Location header shows default-search.site sending you on to Google.
Where it sends data
Destinations our analysis observed Change Default Search Engine contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ext-ads-mvp.captain-products.workers.dev
Change Default Search Engine sends data to ext-ads-mvp.captain-products.workers.dev. 2 other extensions we have analysed send data here.
- default-search.site
Change Default Search Engine sends data to default-search.site. No other extension we have analysed sends data here.