Is Coin Search - your daily rewards tool safe?

High risk

Coin Search reports each visited page URL and hostname to coinsearch.cash when rewards are enabled.

Coin Search installs a content script on every website and, with rewards enabled by default, sends the current page hostname, full URL, and timestamp to coinsearch.cash. It also makes periodic ping requests tied to the extension's local token, but the page URL reporting happens from the content script as pages load.

CoinSearchv1.0.5Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Coin Search reports every page you visit to coinsearch.cash by default

Our dynamic analysis captured the content script sending the hostname, full URL, and timestamp of pages you visit to coinsearch.cash, active by default from install unless the rewards toggle is turned off.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any webpage with the extension enabled.

No search or reward action is required to trigger this.

The extension did this

The content script sends the page's hostname, full URL, and load timestamp to coinsearch.cash.

This happens on document_idle for every page, on every site, because the content script runs on <all_urls>.

Captured request
POSThttps://coinsearch.cash/api/signal

Observed during dynamic analysis across navigations to example.com, amazon.com, ebay.com, and walmart.com; 8 matching requests were captured, each carrying the current page's hostname and full URL.

Headers
Content-Type
application/json
Body
{  "domain": "www.amazon.com",  "url": "https://www.amazon.com/s?k=usb+cable",  "timestamp": "2026-09-08T19:25:20.654Z"}
What each signal request contains
  • Site you visited
    www.amazon.com

    The domain of the page currently open in your browser.

  • Full page address
    https://www.amazon.com/s?k=usb+cable

    The complete URL, including any search terms, product IDs, or account-specific paths in it.

  • Timestamp
    2026-09-08T19:25:20.654Z

    The exact moment the page was loaded, to the millisecond.

The code that does this

The reporting flag defaults to on for every new install

Readable version

Install handler, readable

chrome.runtime.onInstalled.addListener(async ({ reason }) => {  if (reason === "install") {    // ...open welcome tab, generate a uuid, register it with the server...  }  chrome.alarms.create("hourlyPing", { periodInMinutes: 60 });  // Reporting is turned ON for every new install, with no prompt:  await chrome.storage.local.set({ opt_out: true });});

Page-load handler, readable

chrome.storage.local.get(["opt_out", "last_ping"], (settings) => {  if (settings.opt_out === true) {    const signal = {      domain: window.location.hostname,      url: window.location.href,      timestamp: new Date().toISOString(),    };    fetch("https://coinsearch.cash/api/signal", {      method: "POST",      headers: { "Content-Type": "application/json" },      body: JSON.stringify(signal),    });  }});
Where the browsing data goes
    • coinsearch.cash

    Receives your visited hostname, full page URL, and a timestamp on every page load while reporting is on, which is the state set at install.

Where it sends data

Destinations our analysis observed Coin Search - your daily rewards tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • coinsearch.cash

    Coin Search - your daily rewards tool sends data to coinsearch.cash. No other extension we have analysed sends data here.

Updated 30 September 2026njodldkbolbomneajeffdhedmnnplhpe