Is MapQuest Directions safe?

Medium risk

MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.

Each keystroke in the new tab search box is sent to mapquestdrivingdirections.org as the user types. When a new tab opens, the extension fetches arbitrary HTML from the same server and renders it directly into the page without sanitization, allowing the server to control page content. Search result clicks may also be routed through a tracking redirect that includes the user's install date and campaign ID.

MapQuest Directionsv1.1.5Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Search clicks routed with install date

On the alternative new-tab search branch, a click builds a GET to mapquestdrivingdirections.org/admin/public/link with the search value, install date, and campaign ID.

Dynamic analysis didn't reach it but saw install fire automatically.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click a search suggestion or submit a search from the extension's new tab page.

The extension did this

The extension builds a MapQuest-domain link that carries the search value with install and campaign metadata.

02EvidenceFIELD TABLE
Query fields assembled by the click handlers
FieldValueWhy it matters
Clicked search value
directions to airport (illustrative)Shows what you selected or typed in the extension's search box.
Install date
2026-06-15 (illustrative)Ties the search click to when this browser installed the extension.
Campaign identifier
mq_campaign_17 (illustrative)Can group your browser with the distribution campaign that supplied the identifier.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://mapquestdrivingdirections.org/admin/public/link
04EvidenceCODE COMPARE
The code that does this

Search handlers construct the routed link

What it actually does
Campaign identifier and API host setupscript.js
let apiUrl;
let campaignid = "";

chrome.storage.local.get(['apiUrl'], results => {
  if (results && results.apiUrl) {
    apiUrl = "https://mapquestdrivingdirections.org/admin2";
    callForSetApiURL();
  } else {
    apiUrl = "https://mapquestdrivingdirections.org/admin";
    callForSetApiURL();
  }
});

chrome.runtime.onMessageExternal.addListener((request, sender, sendResponse) => {
  if (request.apiUrlChange) {
    apiUrl = "https://mapquestdrivingdirections.org/admin2";
    getShortcutOnload(apiUrl);
    callPixelFunc(apiUrl);
    chrome.storage.local.set({ apiUrl: true });
  }
  if (request.campaignid) {
    chrome.storage.local.get(['campaignid'], results => {
      if (!results.campaignid) {
        chrome.storage.local.set({ campaignid: request.campaignid });
      }
    });
  }
})

// get campaignid 
chrome.storage.local.get(['campaignid'], results => {
  if (results && results.campaignid) {
    campaignid = results.campaignid;
  }
});
Install date storagebackground.js
chrome.runtime.onInstalled.addListener(function (details) {
  if (details.reason === "install") {
    // get installed date 
    const currentDate = new Date();
    const currentDateTime = new Date();
    const getFormateDate = formatDate(currentDate, "currentDate");
    const getFormateDateTime = formatDate(currentDateTime, "currentDateTime");
    // set value in local storage
    chrome.storage.local.set({ currentDate: getFormateDate });
    chrome.storage.local.set({ date: getFormateDateTime });

    // Query all open tabs
    handleContentScriptMessage()
    let checkApiUrl = setInterval(function () {
      if (apiUrl) {
        fetch(`${apiUrl}/public/install`);
        fetch(`${apiUrl}/public/pixels`);
        setUninstallURL()
        clearInterval(checkApiUrl);
      } else {
        console.log('not api url');
      }
    }, 500);

    chrome.windows.getAll((wins) =>
      wins.forEach(
        (win) => win.type === "popup" && chrome.windows.remove(win.id)
      )
    );
    chrome.tabs.create({}, function (tab) { });
  } else if (details.reason === "chrome_update") {
    chrome.tabs.create({}, function (tab) { });
  } else if (details.reason === "update") {
    chrome.tabs.create({}, function (tab) { });
  }
});
Autocomplete click pathscript.js
$("#search-box").on("input", async function (e) {
  searchTerm = e.target.value;

  let removeSpace = searchTerm.trim();
  if (removeSpace.length > 0) {
    const rawResponse = await axios
      .get(
        `${apiUrl}/public/autosuggest?searchTerm=` +
        searchTerm,
      );
    const content = await rawResponse.data;
    const data = content.gossip.results;
    let word;
    // Display search suggestions
    const suggestionList = data
      .map((suggestion) => {
        var listitem = suggestion.key;
        word = "<span>" + listitem.substr(0, removeSpace.length) + "</span>";
        word += "<b>" + listitem.substr(removeSpace.length) + "</b>";
        if (word == searchTerm) {
          return "";
        } else {
          return `<li class="autocomplete"><a data-id='${listitem}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg>${word}</a></li>`;
        }
      })
      .join("");
    $('#suggestions').html(suggestionList);
  }
  const element = searchBox.value.length;
  if (removeSpace.length && element > 0) {
    $(".search_results").addClass("open");
    $('body').addClass('body_height');
    $("#suggestions").removeClass('clo')
    $("#suggestions").removeClass('closed')
    $(".for_open").addClass("open");
    $(".search_icon").addClass("close");
    $(".icon_show").removeClass("close");
    $("#search-icon").html(
      `<a class="search__suggestions" data-id='${searchTerm}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg></a>`
    );
    $("input").parent().addClass("focus");
    $(".search_bar").removeClass("empty");
    if ($(".search_results").is(":empty")) {
      $(".search_bar").addClass("empty");
    }
  } else {
    // input value null to show fist like input
    $("#suggestions").addClass('closed')
    $(".search_results").removeClass("open");
    $(".for_open").removeClass("open");
    $(".search_icon").removeClass("close");
    $(".icon_show").addClass("close");
    $("input").parent().removeClass("focus");
    $('body').removeClass('body_height');
  }

  $(".autocomplete").click(async function (e) {
    e.preventDefault();
    const url = $(this).find('a').attr('data-id');
    chrome.storage.local.get(['date'], async results => {
      if (results && results.date) {
        executeSearch(url, 'chrome');
      } else {
        await chrome.storage.local.get(['currentDate'], results => {
          let a = document.createElement("a");
          a.target = "_blank";
          a.href = `${apiUrl}/public/link?q=${url}&installdate=${results.currentDate}&campaignid=${campaignid}`;
          a.click();
        });
      }
    });
  });
  $(".search__suggestions").click(async function (e) {
    e.preventDefault();
    const val = $(this).attr('data-id');
    let a = document.createElement("a");
    a.target = "_blank";
    chrome.storage.local.get(['date'], async results => {
      if (results && results.date) {
        executeSearch(val, 'chrome');
      } else {
        await chrome.storage.local.get(['currentDate'], results => {
          a.href = `${apiUrl}/public/link?q=${searchTerm}&installdate=${results.currentDate}&campaignid=${campaignid}`;
          a.click();
        });
      }
    });
  });
});
05EvidenceTHIRD PARTY LIST
External hosts involved in this path
  • mapquestdrivingdirections.org

    Receives the constructed /admin/public/link GET route and also serves autosuggest, install, pixel, and shortcut endpoints used by the extension.

Data recipients

mapquestdrivingdirections.org
Updated 17 September 2026ljocfgbodlhbdiiojpdnimkomffghman