Is EdPro Circle safe?

Medium risk

EdPro Circle sends the URL of every non-LinkedIn page you finish loading to mymosttrusted.net.

After each tab finishes loading, the extension's background script posts the page URL, tagged with your profile id, to the vendor's detect-link endpoint. This is skipped on LinkedIn pages and when the extension's hide-in-LinkedIn setting is on. The result is a browsing history record sent to the vendor's server.

MMT Networkv0.0.0.3Chrome Web Store
49Risk
Who publishes it

MMT Network - 18 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
MMT Network
Website
www.navig8biz.com/connect-with-joanne

Same store account

18 other listings published from this account, 927 users between them. 1 of them carries a finding.

Grand Connection Networking234LowBNI Philippines147LowBridge Collective91LowEngagePro85LowMaltix Connect65LowCIRA45Low12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

EdPro Circle posts each non-LinkedIn page URL you load to mymosttrusted.net

Code analysis shows the extension posts the address of each completed page load outside linkedin.com to mymosttrusted.net, with the user's profile id.

Not yet observed running.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You finish loading a page on any site that is not linkedin.com.

The extension did this

The extension posts that page's full URL, with your profile id, to mymosttrusted.net.

The code that does this

Navigation listener and request builder

Readable version

Tab update listener

background.js
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  if (changeInfo.status == "complete" && tab?.url) {    // ... LinkedIn cookie refresh (not part of this claim) ...    if (hideinli || chrome.tabs.sendMessage(tabId, { script: "MMTWLEDPROCIRCLEContentLoader", method: "initiate", args: ["callback"] }, null, () => {}),        tab?.url && tab.url.search(/linkedin.com/gm) == -1) {      var { url } = tab;      self.callBackEnd("-v5/detect-link", "POST", { url }, () => {}, true);    }  }});

Request helper

background.js
self.callBackEnd = async function (path, method, body, cb, ...) {  // for non-GET: body gets v, app and profile_id added  body.v = manifest.version; body.app = manifest.name; body.profile_id ||= profileId;  const opts = { method, headers: { Accept: "application/json", "Content-Type": "application/json", trustee: profileId || "" }, body: JSON.stringify(body) };  fetch("https://mymosttrusted.net/api" + path, opts);};
What the request carries
  • Page URL
    https://meet.google.com/abc-defg-hij

    The full address of the page you just loaded, including any query string.

  • Profile id
    a1b2c3d4 (illustrative)

    Your account id with the service, sent in the body and in a trustee header.

  • Version and app name

    Which extension build is sending the request.

Where the address goes
    • mymosttrusted.net

    Vendor API endpoint /api-v5/detect-link that receives each URL with the profile id.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed EdPro Circle contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mymosttrusted.netwidely used

    EdPro Circle sends data to mymosttrusted.net. A widely used service: 39 other extensions we have analysed send data here.

Updated 15 October 2026lfkolbjfhpngnomcpkbjmbcljnniaadj