Is Easy Games Tab & Custom Web Search safe?

Low risk

Easy Games Tab routes all user searches through Yahoo affiliate URLs with hardcoded monetization parameters.

When a user performs a search from the new tab page the extension replaces, the query is forwarded to search.yahoo.com with fixed affiliate codes (hspart, hsimp, param1, param2) that allow the developer to earn revenue from each search. The user's search terms are transmitted to Yahoo alongside these identifying campaign identifiers on every search.

EasyGamesTabv1.0.0.8Firefox Add-ons
20Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI FOUND

Searches route through a Yahoo affiliate URL

The extension routes searches from its new-tab box to Yahoo via a hardcoded affiliate URL, appending the typed term to search.yahoo.com/yhs/search with fixed param1, param2, type, hspart, and hsimp values.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You search from the extension's new-tab page.

Pressing Enter in the search box or clicking the search button starts the same search flow.

The extension did this

The extension sends the search to Yahoo with fixed campaign parameters.

The typed words become the `p` parameter on a `search.yahoo.com/yhs/search` URL.

02EvidenceFIELD TABLE
Fields in the generated search request
FieldValueWhy it matters
Search words
weather tomorrowThe words you type into the extension's search box are included in the URL sent to Yahoo.
Search destination
https://search.yahoo.com/yhs/searchThe request goes to Yahoo's search endpoint rather than staying inside the extension.
Campaign type
type9049412-spa-1474-84518This value ties the search request to a configured campaign or distribution channel.
Partner parameters
param1=1474; param2=84518; hspart=mnet; hsimp=yhs-001These fixed values are sent with each extension search and can be used for attribution.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://search.yahoo.com/yhs/search?param1=1474&param2=84518&type=type9049412-spa-1474-84518&hspart=mnet&hsimp=yhs-001&p=weather%20tomorrow
Browser navigation to Yahoo search; no request body is present for this GET flow.
04EvidenceCODE COMPARE
The code that does this

The source path that builds the Yahoo search URL

What it actually does
Readable hardcoded Yahoo search URLhtml/js/constants.js
var specificConstants = {
    "domain": "easygamestab.com",
    "searchComp": "https://search.yahoo.com/yhs/search?param1=1474&param2=84518&type=type9049412-spa-1474-84518&hspart=mnet&hsimp=yhs-001&p=",
};
Readable search function and event handlershtml/js/homepage.js
function search(searchBox) {
    var searchTerm = searchBox.val().trim();
    if (!searchTerm) return;
    var search = Constants.DEFAULT_SEARCH_URL + searchTerm;
    if (typeof specificConstants !== 'undefined' && !!specificConstants[OtherDimensions.searchComp]) {
        search = specificConstants[OtherDimensions.searchComp] + searchTerm;
    }
    window.location.href = search;
}

(function () {
    HtmlUtil.documentOnLoad(function () {
        const searchBox = $(SEARCH_TEXT_CLASS);
        const searchForm = $(SEARCH_FORM_CLASS);
        const searchBtn = $(SEARCH_BTN_CLASS);
        searchBox.each(function (index) {
            var searchBoxElement = $(searchBox[index]);
            searchBoxElement.on('keypress', function (event) {
                if (event.which === 13) {
                    event.preventDefault();
                    search(searchBoxElement);
                }
            });
            searchBoxElement.focus();
        });

        searchForm.each(function (index) {
            var searchFormElement = $(searchForm[index]);
            var searchBtnElement = searchFormElement.find(SEARCH_BTN_CLASS);
            var searchBoxElement = searchFormElement.find(SEARCH_TEXT_CLASS);
            searchBtnElement.on('click', function (e) {
                e.preventDefault();
                search(searchBoxElement);
            });
        });

    });
})();
05EvidenceCODE COMPARE
The code that does this

The manifest also configures Yahoo as the default search provider

What it actually does
{
  "chrome_settings_overrides": {
    "search_provider": {
      "name": "web search by Yahoo",
      "keyword": "Easy Games Tab",
      "favicon_url": "icons/icon128.png",
      "search_url": "https://search.yahoo.com/yhs/search?hspart=mnet&hsimp=yhs-001&type=type9049412-spa-3583-84499&param1=3583&param2=84499&p={searchTerms}",
      "suggest_url": "https://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10",
      "is_default": true
    }
  }
}
06EvidenceTHIRD PARTY LIST
External search host
  • search.yahoo.com

    Receives extension-initiated search requests containing the typed query and fixed attribution parameters.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on easygamestab.com

    *://easygamestab.com/

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Easy Games Tab & Custom Web Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • search.yahoo.comwidely used

    Easy Games Tab & Custom Web Search sends data to search.yahoo.com. A widely used service: 39 other extensions we have analysed send data here.

Updated 30 September 2026amo-2686042