Is Gradient Blobs safe?
Gradient Blobs sends rendered bookmark URLs to Google's favicon service on its new-tab page.
Gradient Blobs reads your bookmarks to display shortcut tiles, and each rendered tile loads a favicon from s2.googleusercontent.com with the bookmark URL in the request. Searches submitted from the new-tab page go to search.gradientblobs.net with the query text and persistent extension identifiers stored at install time.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Searches include persistent extension identifiers sent to Gradient Blobs
When you use Gradient Blobs' new-tab search, the search query is submitted to search.gradientblobs.net.
The same request also includes values copied from extension storage, including persistent identifiers and installation timing fields.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You submit a search from the extension's new-tab search form.
The extension sends the query together with stored identifiers to search.gradientblobs.net.
- Your search queryweather tomorrow (illustrative)
The text you typed into the new-tab search form is submitted with the request.
- Persistent extension identifiersd7f3a1b2-... (illustrative)
Stored values such as userId, token, and utm_uid can link multiple searches from the same installation.
What it can do
Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on gradientblobs.net
*://gradientblobs.net/*
Store data in your browser
storage
Read and change your bookmarks
bookmarks
Where it sends data
Destinations our analysis observed Gradient Blobs contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s2.googleusercontent.com
Gradient Blobs sends data to s2.googleusercontent.com. 12 other extensions we have analysed send data here.
- gradientblobs.net
Gradient Blobs sends data to gradientblobs.net. No other extension we have analysed sends data here.
- search.gradientblobs.net
Gradient Blobs sends data to search.gradientblobs.net. No other extension we have analysed sends data here.