Is Get Transit Schedules safe?

Medium risk

Get Transit Schedules makes gettransitschedules.com the default search provider and sends address-bar searches to it.

The extension sets gettransitschedules.com as Chrome's default search provider, so address-bar searches and search suggestions are sent to that site. When a search URL opens, its background script appends the stored map-provider choice from Chrome sync storage to the same gettransitschedules.com URL.

Get Transit Schedulesv1.0.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Address-bar searches sent to Get Transit Schedules search endpoints

Address bar search and suggestions route to gettransitschedules.com.

The extension also appends a stored map preference when rewriting matching search-result URLs, so search text, visited URLs, and settings can be included.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user types a search or suggestion query in the browser address bar.

The extension did this

The extension sends the query to gettransitschedules.com and may append a stored selectedMap value to matching search URLs.

Captured request
GEThttps://gettransitschedules.com/admin/public/link?q={searchTerms}; https://gettransitschedules.com/admin/public/autosuggest?searchTerm={searchTerms}
Fields in the request
  • Your search text
    bus schedule downtown (illustrative)

    The words you enter can reveal what route, place, or transit information you are looking for.

  • Search-result URL
    https://gettransitschedules.com/admin/public/link?q=bus%20schedule (illustrative)

    The request URL carries the search term and shows that the query came through the extension's search provider.

  • Stored map preference
    selectedMap=default (illustrative)

    A saved extension setting can be appended to matching search URLs, linking the request to the user's chosen map option.

Observation

Dynamic analysis confirmed the manifest search override and the service worker rewrite that appends the stored selectedMap value to matching search URLs.

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on gettransitschedules.com

    *://gettransitschedules.com/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Get Transit Schedules contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • gettransitschedules.com

    Get Transit Schedules sends data to gettransitschedules.com. No other extension we have analysed sends data here.

Updated 30 September 2026nkeddnodkkdijfghdeilhnjodlgjceaj