Is Flow safe?

Question

Is Flow safe?

Accepted Answer

Flow is high risk. Our dynamic analysis confirmed that every time you search on Google, the Flow for Chrome extension sends your exact search query to a third-party server at uru56.com. The request includes the raw search term, your extension's runtime ID, its version number, a hardcoded affiliate ID (3100), a randomised session token, and a stored identifier retrieved from local storage. The request is made with credentials included, meaning any cookies set on uru56.com are also transmitted. This happens automatically on every Google search page load, without a consent prompt, and is not disclosed in the extension listing. Our dynamic analysis confirmed that the uru56.com server delivers a CSS payload with every response to the extension's search query request. The extension takes the value of a 'css' field from that response and inserts it as a raw <style> element into the Google search page's document head, without any sanitisation or content restrictions. This means the operator of uru56.com can change the visual appearance of Google's search results in your browser at any time, on every Google search you perform with this extension installed. The CSS delivered in our test session included rules targeting Google's own layout classes.

Is Flow for Chrome™ safe?

Findings