Is Earth 3D safe?

High risk

Earth 3D is high risk. Earth 3D's manifest sets itself as Chrome's default search on install. We confirmed searches are sent to earth3d.net, then a System1 affiliate network, then Yahoo, with the query text intact at each hop.

Earth 3Dv3.1.2Chrome Web Store
73Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Earth 3D sets itself as default search and routes queries via an ad network

Earth 3D's manifest sets itself as Chrome's default search on install.

We confirmed searches are sent to earth3d.net, then a System1 affiliate network, then Yahoo, with the query text intact at each hop.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You type a search query into Chrome's address bar and press Enter.

Earth 3D's manifest set itself as the default search provider (is_default: true) on install.

The extension did this

Chrome sends the query to earth3d.net instead of your normal default search engine.

The manifest's search_url template, https://earth3d.net/admin/public/link?q={searchTerms}, is filled with your typed query and requested directly.

The redirect chain a search query travels through before you see results

  1. hop 1

    You did

    Chrome requests earth3d.net/admin/public/link with your search query.

    The extension did

    earth3d.net returns an HTTP 302 redirect to a search-syndication domain.

  2. hop 2

    You did

    Your browser follows the 302 to earthapp-net.s1search.co.

    The extension did

    That domain, part of System1's affiliate search network, returns an HTTP 303 to Yahoo.

  3. hop 3

    You did

    Your browser follows the 303 to Yahoo's UK results page.

    The extension did

    uk.search.yahoo.com renders results for your original query.

Where a search query goes before you see results
    • earth3d.net

    First hop. The manifest-declared default search provider that receives every search you type.

    • earthapp-net.s1search.co

    Affiliate search-syndication domain operated by System1 (formerly Infospace); monetizes the query before forwarding it on.

    • uk.search.yahoo.com

    Final results page shown to you, reached only after the query passes through the two hosts above.

What each search exposes
  • Your search query text
    best italian restaurants near me

    Every term you type into the address bar is sent to earth3d.net and the affiliate network before you see any results.

  • Your search pattern over time
    restaurant search, then flight search, then hotel search, same session

    Because every default search passes through the same override, the sequence of queries over time builds a browsing-interest profile.

Reproduce it yourself

Requests the manifest's search_url template with a sample query and follows the redirect chain, showing every hop the query travels through before reaching results.

Requires
  • curl
  • python3 (used to URL-encode the query)
verify_earth3d_search_redirect.sh · sh
#!/bin/sh# Usage: ./verify_earth3d_search_redirect.sh "your query here"set -eQUERY="${1:-test search term}"ENCODED=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))" "$QUERY")curl -sIL --max-redirs 5 \  "https://earth3d.net/admin/public/link?q=$ENCODED" \  -w '\n---\nFinal URL: %{url_effective}\n'
How to run it
  1. 1Save as verify_earth3d_search_redirect.sh.
  2. 2Run chmod +x verify_earth3d_search_redirect.sh.
  3. 3Run ./verify_earth3d_search_redirect.sh "your query".
  4. 4Read the Location headers in the output to see each redirect hop.

What it can do

Permissions this extension asks for, as declared in version 1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.1.2, which we have not unpacked yet.

  • Read and change your data on earth3d.net

    *://earth3d.net/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

Updated 30 September 2026kbobdmmjbaljcombpliahadgoafgohcd