Is Happy Wild Cats safe?

Medium risk

Happy Wild Cats tags default search requests with a persistent session ID sent to happycatswild.com.

Happy Wild Cats installs happycatswild.com as the default search provider, so browser searches go to its search endpoint with the search terms. Its background worker creates a 32-character session ID, stores it locally, and appends that same value to those search requests.

perrycarl540v1.0.4Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Happy Wild Cats attaches a permanent session ID to every default search

As Chrome's default search engine, Happy Wild Cats attaches a permanent 32-character ID to every search you make, letting happycatswild.com link all your searches to the same browser.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You type a search term into the address bar using Chrome's default search engine.

Happy Wild Cats sets itself as that default provider when it is installed.

The extension did this

A background rule rewrites the outgoing request to attach a permanent session identifier.

The identifier is generated once, stored locally, and reused for every later search.

What happycatswild.com receives with every search
  • Your search term
    wireless earbuds review

    The exact words you type appear in the request, revealing what you searched for.

  • Permanent session ID
    4z16pkq6sa0zpd6izx6hvh1h74dty5uz

    A 32-character code created once and stored forever, so happycatswild.com can tell all your searches came from the same browser.

Captured request
GEThttps://happycatswild.com/search?q=wireless+earbuds+review&session=4z16pkq6sa0zpd6izx6hvh1h74dty5uz

Search results page loaded; no additional response body captured.

The code that does this

background.js: the identifier is minted once, then attached to every search

Readable version
chrome.storage.local.get(["session"], stored => {  let sessionId;  if (stored.session) {    // Reuse the identifier from a previous run.    sessionId = stored.session;  } else {    // First run: mint a new 32-character random identifier and persist it    // in chrome.storage.local so it survives browser restarts.    sessionId = generateRandomBase36String(32);    chrome.storage.local.set({ session: sessionId }, () => {      // Report the new identifier to the vendor once, on creation.      fetch(`https://happycatswild.com/start?session=${sessionId}`, {        mode: "no-cors",        credentials: "same-origin"      });    });  }  // The same identifier is sent one more time if the extension is removed.  chrome.runtime.setUninstallURL(    `https://happycatswild.com/uninstall?session=${sessionId}`  );  // Replace any prior dynamic rule, then install a rule that rewrites  // every main-frame request matching happycatswild.com/search so it  // always carries the stored session ID as a query parameter.  chrome.declarativeNetRequest.getDynamicRules(existingRules => {    chrome.declarativeNetRequest.updateDynamicRules(      { removeRuleIds: existingRules.map(r => r.id) },      () => {        chrome.declarativeNetRequest.updateDynamicRules({          addRules: [{            id: 10,            action: {              type: "redirect",              redirect: {                transform: {                  queryTransform: {                    addOrReplaceParams: [{ key: "session", value: sessionId }]                  }                }              }            },            condition: {              urlFilter: "happycatswild.com/search",              resourceTypes: ["main_frame"]            }          }]        });      }    );  });});function generateRandomBase36String(length) {  return [...Array(length)]    .map(() => (~~(Math.random() * 36)).toString(36))    .join("");}
Where the identifier goes
    • happycatswild.com

    Receives every default-search request tagged with the persistent session ID, plus a one-time install beacon and a final uninstall beacon carrying the same ID.

What it can do

Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on happycatswild.com

    *://happycatswild.com/*

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed Happy Wild Cats contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • happycatswild.com

    Happy Wild Cats sends data to happycatswild.com. No other extension we have analysed sends data here.

Updated 30 September 2026bbnjhnlnhdpahgiimbcaoegafogfmmin