Is CrxMouse safe?

Question

Is CrxMouse safe?

Accepted Answer

CrxMouse is high risk. When you enable the 'Mouse Gestures' opt-in feature, CrxMouse records the URL of every page you navigate to — along with the referring URL, redirect chain, and external link clicks — and sends this data as a POST request to api.mousegesturesapi.com. Dynamic analysis confirmed that the extension transmitted a planted URL to this endpoint across navigations to Google, Amazon, Wikipedia, Reddit, ChatGPT, and claude.ai. On startup, CrxMouse fetches a JSON configuration object from api.mousegesturesapi.com/version/config and caches it locally for 24 hours. This server-supplied configuration controls the URL that browsing history data is sent to, as well as the filtering rules that determine which URL parameters are stripped before transmission. Dynamic analysis confirmed the config endpoint was contacted on startup and that the values it returns — including GrowthBook A/B experiment assignments — appeared in subsequent telemetry transmissions.

Is CrxMouse: Mouse Gestures safe?

Findings