Is MapQuest Directions safe?
MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.
Each keystroke in the new tab search box is sent to mapquestdrivingdirections.org as the user types. When a new tab opens, the extension fetches arbitrary HTML from the same server and renders it directly into the page without sanitization, allowing the server to control page content. Search result clicks may also be routed through a tracking redirect that includes the user's install date and campaign ID.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Search clicks routed with install date
On the alternative new-tab search branch, a click builds a GET to mapquestdrivingdirections.org/admin/public/link with the search value, install date, and campaign ID.
Dynamic analysis didn't reach it but saw install fire automatically.
What actually happens
You click a search suggestion or submit a search from the extension's new tab page.
The extension builds a MapQuest-domain link that carries the search value with install and campaign metadata.
Query fields assembled by the click handlers
- Clicked search valuedirections to airport (illustrative)
Shows what you selected or typed in the extension's search box.
- Install date2026-06-15 (illustrative)
Ties the search click to when this browser installed the extension.
- Campaign identifiermq_campaign_17 (illustrative)
Can group your browser with the distribution campaign that supplied the identifier.
Captured request
The code that does this
Search handlers construct the routed link
Campaign identifier and API host setup
script.jslet apiUrl;let campaignid = "";chrome.storage.local.get(['apiUrl'], results => { if (results && results.apiUrl) { apiUrl = "https://mapquestdrivingdirections.org/admin2"; callForSetApiURL(); } else { apiUrl = "https://mapquestdrivingdirections.org/admin"; callForSetApiURL(); }});chrome.runtime.onMessageExternal.addListener((request, sender, sendResponse) => { if (request.apiUrlChange) { apiUrl = "https://mapquestdrivingdirections.org/admin2"; getShortcutOnload(apiUrl); callPixelFunc(apiUrl); chrome.storage.local.set({ apiUrl: true }); } if (request.campaignid) { chrome.storage.local.get(['campaignid'], results => { if (!results.campaignid) { chrome.storage.local.set({ campaignid: request.campaignid }); } }); }})// get campaignid chrome.storage.local.get(['campaignid'], results => { if (results && results.campaignid) { campaignid = results.campaignid; }});Install date storage
background.jschrome.runtime.onInstalled.addListener(function (details) { if (details.reason === "install") { // get installed date const currentDate = new Date(); const currentDateTime = new Date(); const getFormateDate = formatDate(currentDate, "currentDate"); const getFormateDateTime = formatDate(currentDateTime, "currentDateTime"); // set value in local storage chrome.storage.local.set({ currentDate: getFormateDate }); chrome.storage.local.set({ date: getFormateDateTime }); // Query all open tabs handleContentScriptMessage() let checkApiUrl = setInterval(function () { if (apiUrl) { fetch(`${apiUrl}/public/install`); fetch(`${apiUrl}/public/pixels`); setUninstallURL() clearInterval(checkApiUrl); } else { console.log('not api url'); } }, 500); chrome.windows.getAll((wins) => wins.forEach( (win) => win.type === "popup" && chrome.windows.remove(win.id) ) ); chrome.tabs.create({}, function (tab) { }); } else if (details.reason === "chrome_update") { chrome.tabs.create({}, function (tab) { }); } else if (details.reason === "update") { chrome.tabs.create({}, function (tab) { }); }});Autocomplete click path
script.js$("#search-box").on("input", async function (e) { searchTerm = e.target.value; let removeSpace = searchTerm.trim(); if (removeSpace.length > 0) { const rawResponse = await axios .get( `${apiUrl}/public/autosuggest?searchTerm=` + searchTerm, ); const content = await rawResponse.data; const data = content.gossip.results; let word; // Display search suggestions const suggestionList = data .map((suggestion) => { var listitem = suggestion.key; word = "<span>" + listitem.substr(0, removeSpace.length) + "</span>"; word += "<b>" + listitem.substr(removeSpace.length) + "</b>"; if (word == searchTerm) { return ""; } else { return `<li class="autocomplete"><a data-id='${listitem}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg>${word}</a></li>`; } }) .join(""); $('#suggestions').html(suggestionList); } const element = searchBox.value.length; if (removeSpace.length && element > 0) { $(".search_results").addClass("open"); $('body').addClass('body_height'); $("#suggestions").removeClass('clo') $("#suggestions").removeClass('closed') $(".for_open").addClass("open"); $(".search_icon").addClass("close"); $(".icon_show").removeClass("close"); $("#search-icon").html( `<a class="search__suggestions" data-id='${searchTerm}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg></a>` ); $("input").parent().addClass("focus"); $(".search_bar").removeClass("empty"); if ($(".search_results").is(":empty")) { $(".search_bar").addClass("empty"); } } else { // input value null to show fist like input $("#suggestions").addClass('closed') $(".search_results").removeClass("open"); $(".for_open").removeClass("open"); $(".search_icon").removeClass("close"); $(".icon_show").addClass("close"); $("input").parent().removeClass("focus"); $('body').removeClass('body_height'); } $(".autocomplete").click(async function (e) { e.preventDefault(); const url = $(this).find('a').attr('data-id'); chrome.storage.local.get(['date'], async results => { if (results && results.date) { executeSearch(url, 'chrome'); } else { await chrome.storage.local.get(['currentDate'], results => { let a = document.createElement("a"); a.target = "_blank"; a.href = `${apiUrl}/public/link?q=${url}&installdate=${results.currentDate}&campaignid=${campaignid}`; a.click(); }); } }); }); $(".search__suggestions").click(async function (e) { e.preventDefault(); const val = $(this).attr('data-id'); let a = document.createElement("a"); a.target = "_blank"; chrome.storage.local.get(['date'], async results => { if (results && results.date) { executeSearch(val, 'chrome'); } else { await chrome.storage.local.get(['currentDate'], results => { a.href = `${apiUrl}/public/link?q=${searchTerm}&installdate=${results.currentDate}&campaignid=${campaignid}`; a.click(); }); } }); });});External hosts involved in this path
- mapquestdrivingdirections.org
Receives the constructed /admin/public/link GET route and also serves autosuggest, install, pixel, and shortcut endpoints used by the extension.
What it can do
Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Run searches with your default search engine
search
Store data in your browser
storage
Where it sends data
Destinations our analysis observed MapQuest Directions contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- mapquestdrivingdirections.org
MapQuest Directions sends data to mapquestdrivingdirections.org. No other extension we have analyzed sends data here.