Is City Scapes safe?

Medium risk

City Scapes sends every new-tab search query to a third-party monetized search proxy instead of your browser's default search engine.

The extension's new-tab page includes a search box, but City Scapes never requests the 'search' permission needed to use the browser's built-in search API. As a result, every query typed into that box is sent directly to landscape-extensions.com, a shared search-redirect domain used across multiple unrelated extensions rather than one specific to this listing.

Syndic8v1.0.1Firefox Add-ons
46Risk
Who publishes it

Syndic8 - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Syndic8
Website
landscape-extensions.com/

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.aviationstack.com
Also called by 5 other listings
landscape-extensions.com
Also called by 5 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

City Scapes new-tab search routes your query through landscape-extensions.com

We observed the new-tab search box send the typed query to landscape-extensions.com, which redirected to Yahoo.

The extension does not request the permission needed to use the browser's own search.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You type a query in the new-tab search box and press Enter.

The extension did this

The tab opens landscape-extensions.com/search with your query, not your default search engine.

Captured request
GEThttps://landscape-extensions.com/search?ext=ext_nj3dhxm6&q=test_query_xyz

302 redirect to search.yahoo.com/search?p=test_query_xyz; the tab landed on Yahoo results.

The code that does this

Search submit handler and hardcoded endpoint

Readable version

Same logic, reformatted

assets/index-BwtQulYD.js
searchForm.addEventListener("submit", (event) => {  event.preventDefault();  const query = searchInput.value.trim();  if (!query) { searchInput.focus(); return; }  if (typeof chrome !== "undefined" && chrome.search && chrome.search.query) {    chrome.search.query({ text: query, disposition: "CURRENT_TAB" });  } else if (typeof browser !== "undefined" && browser.search && browser.search.search) {    browser.search.search({ query });  } else {    window.location.href = SEARCH_PROXY_URL + encodeURIComponent(query);  }});
What leaves the page
  • Search query
    test_query_xyz

    Whatever you type into the search box.

  • Extension tag
    ext=ext_nj3dhxm6

    A fixed identifier that differs from this listing's own ID.

Where the query goes
    • landscape-extensions.com

    Receives the query first; answered with a redirect to Yahoo in our test.

    • search.yahoo.com

    Final destination of the redirect in our test.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.open-meteo.com

    https://api.open-meteo.com/*

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Read your physical location

    geolocation

Where it sends data

Destinations our analysis observed City Scapes contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • landscape-extensions.com

    City Scapes sends data to landscape-extensions.com. 5 other extensions we have analyzed send data here.

Updated 22 October 2026amo-3039504