Is FedEx Tracking safe?
FedEx Tracking redirects all omnibox searches to trackingnumbers.org and sets a persistent UUID tracking cookie that is restored if deleted.
On installation, the extension overrides Chrome's default search engine so all omnibox queries are sent to trackingnumbers.org/admin-fedex/public/link. It also generates a UUID on first install, stores it in synced storage, and sets a 5-year cookie on trackingnumbers.org. A cookie listener actively re-creates that cookie if the user deletes it.
Strong link to a flagged operator: 2 of the 2 other listings from the same operator are rated high or critical for malicious behavior. Flagged: USPS Tracking (high), UPS Tracking (high).
Who publishes itUSPS Tracking - 2 other listings from the same operator, 2 of them carrying a finding
USPS Tracking - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 90k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Default Search Engine Replaced With trackingnumbers.org
Branded 'FedEx Tracking,' this extension sets itself as the default search engine.
Once accepted, address-bar input routes to trackingnumbers.org/admin-fedex/public/link, so that host gets every search term.
Confirmed on activation.
What actually happens
You type a search into the Chrome address bar.
Any term you type and submit from the omnibox, on any site.
The search is routed to trackingnumbers.org instead of the search engine you previously used.
The query, including what you typed, is delivered to a host bundled with this extension rather than your chosen provider.
The code that does this
The default-search declaration shipped in the extension's manifest.
What the declaration does
// On install, Chrome sets this host as the default search engine.// Every address-bar query then resolves to:// https://trackingnumbers.org/admin-fedex/public/link?q=<your query>// Autosuggest dropdown entries are fetched from:// https://trackingnumbers.org/admin-fedex/public/autosuggest?searchTerm=<partial>// The extension is branded "FedEx Tracking"; the search host is unrelated// to the FedEx brand and is named only "Online" in the declaration.Captured request
Illustrative omnibox request: each address-bar search resolves to this endpoint with the typed term in the q parameter. The autosuggest endpoint (.../public/autosuggest?searchTerm=...) is queried as the user types.
Captured request
Observed during dynamic analysis on activation: the service worker contacts the admin-fedex backend, corroborating that the search-override host is the live destination configured by the extension.
Where address-bar searches are routed
- trackingnumbers.org
Receives every omnibox search term via /admin-fedex/public/link and as-you-type input via /admin-fedex/public/autosuggest. Also contacted on install; holds the uid cookie.
Caveat on the install prompt
Chrome shows a one-time prompt before applying a default-search-engine override. The routing described here takes effect once that prompt is accepted. The override is declared unconditionally in the shipped manifest; whether it activates depends on the user accepting the prompt.
Persistent 5-Year Tracking Cookie, Restored When Deleted
On install, the extension makes a random UUID, stores it in chrome.storage.sync, and sets a 'uid' cookie on trackingnumbers.org, 5-year expiry.
A listener restores it if removed or on startup.
Confirmed: cookie, expiry, heavy write volume.
What actually happens
You install the extension (or delete its tracking cookie).
No further action is required; the identifier is created on install and re-created if removed.
A persistent UUID is written as a cookie on trackingnumbers.org with a five-year lifetime, and is re-created if you delete it.
The same UUID is also kept in chrome.storage.sync, which is the source used to restore the cookie.
The persistent identifier this extension maintains
- Your tracking ID (uid)4e6e1f55-1c64-47a7-be1f-f43b840d0500
A random identifier unique to your install. It lets trackingnumbers.org recognise you across visits for as long as it persists.
- Where it is storeduid cookie on trackingnumbers.org (secure, sameSite=strict)
The identifier is written as a cookie on trackingnumbers.org, so it is sent with direct requests to that host.
- How long it lastsexpires 2031-06-14 (5 years)
The cookie is set to expire five years after it is written, far longer than typical session cookies.
- Backup copychrome.storage.sync { uid: "4e6e1f55-..." }
A second copy is held in extension storage and used to put the cookie back if you delete it.
The code that does this
The cookie creation and restore-on-removal logic, from the extension's background service worker.
Cookie factory
const DOMAIN = "trackingnumbers.org";const FIVE_YEARS_SEC = 5 * 365 * 24 * 60 * 60; // five-year lifetimefunction makeUidCookie(uid) { return { url: `https://${DOMAIN}`, name: "uid", value: uid, sameSite: "strict", secure: true, expirationDate: Math.floor(Date.now() / 1000) + FIVE_YEARS_SEC, };}Mint, restore-on-removal, and startup re-creation
// On fresh install: mint and store the identifier, then set the cookie.chrome.runtime.onInstalled.addListener(async ({ reason }) => { if (reason === "install") { const uid = crypto.randomUUID(); await chrome.storage.sync.set({ uid, randomNumber }); await chrome.cookies.set(makeUidCookie(uid)); // ... }});// If the cookie is deleted, put it back from storage.chrome.cookies.onChanged.addListener(async ({ cookie, removed }) => { if (removed && cookie.domain.endsWith(DOMAIN) && cookie.name === "uid") { const { uid } = await chrome.storage.sync.get("uid"); if (uid) await chrome.cookies.set(makeUidCookie(uid)); }});// On browser startup, re-create the cookie if it is missing but the UID exists.(async () => { const cookie = await chrome.cookies.get({ url: `https://${DOMAIN}`, name: "uid" }); if (!cookie) { const { uid } = await chrome.storage.sync.get("uid"); if (uid) await chrome.cookies.set(makeUidCookie(uid)); }})();When this fires
On every browser startup
On every browser startup the extension checks for the uid cookie and re-creates it from stored state if it is missing, in addition to restoring it immediately whenever it is deleted.
Where the persistent identifier is sent
- trackingnumbers.org
Holds the uid cookie and gets it on direct requests, including searches routed to /admin-fedex/public/link. Same host contacted on install and set as the default search engine.
What it can do
Permissions this extension asks for, as declared in version 1.0.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on trackingnumbers.org
https://trackingnumbers.org/*
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed FedEx Tracking contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- trackingnumbers.org
FedEx Tracking sends data to trackingnumbers.org. One other extension we have analyzed sends data here.