Is Games Search safe?

Medium risk

Games Search recreates its vendor-domain ID and user-agent cookies after they are deleted.

Games Search stores a generated unique ID and a base64-encoded browser user agent in cookies for arcadegamesfreeapp.com. Its background worker watches for those cookies to be removed and recreates them shortly afterward while the extension is active.

v2.1.3Chrome Web Store
46Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Games Search recreates a deleted tracking cookie within 1.5 seconds

The background worker recreates deleted tracking cookies on arcadegamesfreeapp.com within about 1.5 seconds.

We deleted both cookies and watched the same identifier reappear from the extension's own service worker.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You delete the ext_unique_id or ext_user_agent cookie for arcadegamesfreeapp.com.

This happens whether you remove it by hand in DevTools, through a privacy extension, or via the browser's cookie-clearing tools.

The extension did this

The extension's background service worker rewrites the same tracking cookie within about 1.5 seconds.

The restored cookie holds the exact value it had before deletion, so your tracking history is not reset.

What each recreated cookie carries
  • Persistent install ID
    playgames_1788880319758_gvtlh2vnb

    A random ID generated once and rewritten every time you delete it, letting the site tie your visits together indefinitely.

  • Your browser signature
    TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyOC4wLjAuMCBTYWZhcmkvNTM3LjM2

    Your full browser version string, base64-encoded, stored in a second cookie the site reads directly on every visit.

Deleting either cookie triggers the same debounced respawn

  1. ~1.5s after deletion

    You did

    Delete the ext_unique_id cookie for arcadegamesfreeapp.com.

    The extension did

    chrome.cookies.onChanged fires, then the listener rewrites ext_unique_id with the same identifier.

  2. ~1.5s after deletion

    You did

    Delete the ext_user_agent cookie for arcadegamesfreeapp.com.

    The extension did

    The listener detects the removal and restores ext_user_agent with the same encoded value.

Check if you're affected

Deletes both tracking cookies from the extension's own console and shows the same identifier come back within seconds.

Requires
  • Chrome with the extension installed
  • Developer mode enabled in chrome://extensions
verify-cookie-respawn.js · js
// Run from the extension's own service worker console.async function testRespawn(name) {  const before = await chrome.cookies.get({ url: 'https://arcadegamesfreeapp.com', name });  console.log(`before: ${name} =`, before && before.value);  await chrome.cookies.remove({ url: 'https://arcadegamesfreeapp.com', name });  console.log(`deleted ${name}, waiting 3s...`);  await new Promise((r) => setTimeout(r, 3000));  const after = await chrome.cookies.get({ url: 'https://arcadegamesfreeapp.com', name });  console.log(`after: ${name} =`, after && after.value);  console.log(`same value restored: ${!!(before && after && before.value === after.value)}`);}await testRespawn('ext_unique_id');await testRespawn('ext_user_agent');
How to run it
  1. 1Open chrome://extensions with Developer mode on.
  2. 2Click the extension's 'service worker' link.
  3. 3Paste this in its console.
  4. 4Watch the same ID reappear.
Where the tracking cookies live
    • arcadegamesfreeapp.com

    Reads the ext_unique_id and ext_user_agent cookies on every page load under this domain, including the extension's own default search results pages.

What we tested

We deleted the cookies from the extension's own service worker context. The same listener also covers removals from the browser's cookie manager or a privacy extension, since Chrome does not report the source.

What it can do

Permissions this extension asks for, as declared in version 2.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on arcadegamesfreeapp.com

    https://arcadegamesfreeapp.com/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed Games Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • arcadegamesfreeapp.com

    Games Search sends data to arcadegamesfreeapp.com. No other extension we have analysed sends data here.

Updated 30 September 2026eheokfekdhicohflnahpfmifnlnbkfoj