Is Harry Potter Cursors safe?
Harry Potter Cursors is high risk. On Google search result pages, a content script sends the browser to ugnewtab.net with your search terms. Dynamic analysis observed the redirect and a further hop to rpdsrch.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Harry Potter Cursors forwards your Google searches to ugnewtab.net
On Google search result pages, a content script sends the browser to ugnewtab.net with your search terms.
Dynamic analysis observed the redirect and a further hop to rpdsrch.com.
What actually happens
You search on Google and the results page starts loading.
The page is www.google.com/search?q=harry+potter (illustrative query).
The extension replaces the tab with ugnewtab.net and your search terms.
It sets a sessionStorage flag first, so each tab session is redirected once.
Captured request
HTTP 307, then a second request to the same URL answered HTTP 302 redirecting to 844.us.rpdsrch.com. The response set a __Secure-uid cookie (Max-Age 31536000).
The code that does this
Encoded string table and the check that gates the redirect
Decoded string table
["https://ugnewtab.net/search?sid=hpc&q=","www.google.","/search","location","hostname","pathname","search","replace","sessionStorage","cursor-applied","getItem","setItem","URLSearchParams","get","q","encodeURIComponent"]Equivalent logic
if (location.hostname.startsWith('www.google.') && location.pathname === '/search' && !sessionStorage.getItem('cursor-applied')) { sessionStorage.setItem('cursor-applied', JSON.stringify(true)); const q = new URLSearchParams(location.search).get('q'); if (q) location.replace('https://ugnewtab.net/search?sid=hpc&q=' + encodeURIComponent(q));}What leaves the browser
- Search queryq=harry+potter (illustrative)
The words you typed into Google are copied into the destination URL.
- Campaign idsid=hpc
A fixed identifier attached to every redirect.
Hosts contacted
- ugnewtab.net
Receives the redirected search with your query; answers with a redirect.
- 844.us.rpdsrch.com
Next hop named in the redirect response from ugnewtab.net.
What it can do
Permissions this extension asks for, as declared in version 2.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Store data in your browser
storage