Is Custom Chrome Shortcut Manager safe?

Medium risk

Custom Chrome Shortcut Manager sends shortcut URLs, searches, calculator expressions, and aliases to Google Analytics.

When you use the omnibox shortcut, the extension posts the entered destination URL, search query, calculator expression, or alias details to Google Analytics. The analytics payload is sent with a persistent client ID stored locally, and alias events can include destination URLs loaded from the extension's synced alias storage.

Sean Smithv1.2.0Chrome Web Store
45Risk
Who publishes it

Sean Smith - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Sean Smith
Website
github.com/sean-smith/chrome_shortcuts/issues

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Omnibox shortcuts send typed destinations to Google Analytics

The extension's omnibox shortcut can send the destination URL, search query, calculator expression, or saved alias you typed to Google Analytics, tagged with a persistent client ID from local storage linking events over time.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user enters an omnibox shortcut or query.

The extension did this

The extension posts destination URLs, search queries, calculator expressions, aliases, and a persistent client ID to Google Analytics.

Captured request
POSTwww.google-analytics.com/mp/collect
Fields in the request
  • Your typed URL or destination
    https://example.com/article (illustrative)

    This can reveal the page or destination you chose through the omnibox shortcut.

  • Extension storage identifier
    clientId: d7f3a1b2-... (illustrative)

    A persistent client ID from extension storage can link multiple analytics events from the same browser profile.

What it can do

Permissions this extension asks for, as declared in version 1.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on www.google-analytics.com

    https://www.google-analytics.com/

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Custom Chrome Shortcut Manager contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Custom Chrome Shortcut Manager sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026ijihchgjhagfhdkhagnmlebpepjlecml