Is Happy Wild Cats safe?
Happy Wild Cats tags default search requests with a persistent session ID sent to happycatswild.com.
Happy Wild Cats installs happycatswild.com as the default search provider, so browser searches go to its search endpoint with the search terms. Its background worker creates a 32-character session ID, stores it locally, and appends that same value to those search requests.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Happy Wild Cats attaches a permanent session ID to every default search
As Chrome's default search engine, Happy Wild Cats attaches a permanent 32-character ID to every search you make, letting happycatswild.com link all your searches to the same browser.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You type a search term into the address bar using Chrome's default search engine.
Happy Wild Cats sets itself as that default provider when it is installed.
A background rule rewrites the outgoing request to attach a permanent session identifier.
The identifier is generated once, stored locally, and reused for every later search.
- Your search termwireless earbuds review
The exact words you type appear in the request, revealing what you searched for.
- Permanent session ID4z16pkq6sa0zpd6izx6hvh1h74dty5uz
A 32-character code created once and stored forever, so happycatswild.com can tell all your searches came from the same browser.
Search results page loaded; no additional response body captured.
background.js: the identifier is minted once, then attached to every search
chrome.storage.local.get(["session"], stored => { let sessionId; if (stored.session) { // Reuse the identifier from a previous run. sessionId = stored.session; } else { // First run: mint a new 32-character random identifier and persist it // in chrome.storage.local so it survives browser restarts. sessionId = generateRandomBase36String(32); chrome.storage.local.set({ session: sessionId }, () => { // Report the new identifier to the vendor once, on creation. fetch(`https://happycatswild.com/start?session=${sessionId}`, { mode: "no-cors", credentials: "same-origin" }); }); } // The same identifier is sent one more time if the extension is removed. chrome.runtime.setUninstallURL( `https://happycatswild.com/uninstall?session=${sessionId}` ); // Replace any prior dynamic rule, then install a rule that rewrites // every main-frame request matching happycatswild.com/search so it // always carries the stored session ID as a query parameter. chrome.declarativeNetRequest.getDynamicRules(existingRules => { chrome.declarativeNetRequest.updateDynamicRules( { removeRuleIds: existingRules.map(r => r.id) }, () => { chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: 10, action: { type: "redirect", redirect: { transform: { queryTransform: { addOrReplaceParams: [{ key: "session", value: sessionId }] } } } }, condition: { urlFilter: "happycatswild.com/search", resourceTypes: ["main_frame"] } }] }); } ); });});function generateRandomBase36String(length) { return [...Array(length)] .map(() => (~~(Math.random() * 36)).toString(36)) .join("");}- happycatswild.com
Receives every default-search request tagged with the persistent session ID, plus a one-time install beacon and a final uninstall beacon carrying the same ID.
What it can do
Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on happycatswild.com
*://happycatswild.com/*
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed Happy Wild Cats contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- happycatswild.com
Happy Wild Cats sends data to happycatswild.com. No other extension we have analysed sends data here.