Is City Scapes safe?
City Scapes sets your browser's default search engine to landscape-extensions.com, an unbranded third-party search proxy.
Installing City Scapes replaces Chrome's default search provider with landscape-extensions.com, tagged with a per-install tracking ID, so any search typed in the address bar or the extension's own new-tab search box is sent there instead of your usual search engine. The store listing only advertises photos, a clock, and weather, and never discloses this change to your default search engine. The same domain and tracking-parameter pattern appears in several other near-identical "new tab" extensions on Chrome and Firefox.
Who publishes itSyndic8 Asia Pte Ltd - 7 other listings from the same operator, 2 of them carrying a finding
Syndic8 Asia Pte Ltd - 7 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 260k+ users between them. 2 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
City Scapes takes over your browser's default search engine
Code analysis shows installing City Scapes changes your default search engine to landscape-extensions.com, undisclosed in the listing.
Every search from the address bar or new tab is routed there with a per-install tracking ID.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You install City Scapes for its new-tab photos, and accept (or do not decline) Chrome's one-time default-search-engine prompt.
Chrome shows this confirmation for any extension that requests to become the default search provider.
The browser's default search engine becomes landscape-extensions.com, an unbranded third-party domain, for every search you make anywhere in the browser.
This applies to the address bar and the new-tab search box alike, not just an in-page widget.
- New default search URLhttps://landscape-extensions.com/search?ext=ext_nj3dhxm6&q={searchTerms}
Every query typed anywhere in the browser is sent to this address once the override is active.
- Per-install tracking IDext_nj3dhxm6
A fixed identifier tied to this specific listing, sent with every search so responses can be attributed back to this install.
- Set as defaulttrue
Tells Chrome to make this the active default search engine for the browser, not an optional extra option.
New-tab search box also resolves through the new default
Readable equivalent
deobfuscated/assets/index-BwtQulYD.js:1207-1212if (typeof chrome !== "undefined" && chrome.search && chrome.search.query) { chrome.search.query({ text: query, disposition: "CURRENT_TAB" });} else if (typeof browser !== "undefined" && browser.search && browser.search.search) { browser.search.search({ query: query });} else { window.location.href = `${FALLBACK_SEARCH_URL}${encodeURIComponent(query)}`;}- Contact linkhttps://example.com/contact-us
Points at an unmodified placeholder domain rather than a real vendor contact page.
- Privacy policy linkhttps://example.com/privacy-policy
Points at the same placeholder domain, so there is no real privacy policy describing what landscape-extensions.com does with search queries.
- Terms linkhttps://example.com/terms-conditions
Also the unmodified placeholder domain.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed City Scapes contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- landscape-extensions.com
City Scapes sends data to landscape-extensions.com. 5 other extensions we have analyzed send data here.