Is MapQuest Directions safe?
MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.
Each keystroke in the new tab search box is sent to mapquestdrivingdirections.org as the user types. When a new tab opens, the extension fetches arbitrary HTML from the same server and renders it directly into the page without sanitization, allowing the server to control page content. Search result clicks may also be routed through a tracking redirect that includes the user's install date and campaign ID.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Search clicks routed with install date
On the alternative new-tab search branch, a click builds a GET to mapquestdrivingdirections.org/admin/public/link with the search value, install date, and campaign ID.
Dynamic analysis didn't reach it but saw install fire automatically.
You click a search suggestion or submit a search from the extension's new tab page.
The extension builds a MapQuest-domain link that carries the search value with install and campaign metadata.
| Field | Value | Why it matters | |
|---|---|---|---|
Clicked search value | directions to airport (illustrative) | Shows what you selected or typed in the extension's search box. | |
Install date | 2026-06-15 (illustrative) | Ties the search click to when this browser installed the extension. | |
Campaign identifier | mq_campaign_17 (illustrative) | Can group your browser with the distribution campaign that supplied the identifier. |
Search handlers construct the routed link
let apiUrl;
let campaignid = "";
chrome.storage.local.get(['apiUrl'], results => {
if (results && results.apiUrl) {
apiUrl = "https://mapquestdrivingdirections.org/admin2";
callForSetApiURL();
} else {
apiUrl = "https://mapquestdrivingdirections.org/admin";
callForSetApiURL();
}
});
chrome.runtime.onMessageExternal.addListener((request, sender, sendResponse) => {
if (request.apiUrlChange) {
apiUrl = "https://mapquestdrivingdirections.org/admin2";
getShortcutOnload(apiUrl);
callPixelFunc(apiUrl);
chrome.storage.local.set({ apiUrl: true });
}
if (request.campaignid) {
chrome.storage.local.get(['campaignid'], results => {
if (!results.campaignid) {
chrome.storage.local.set({ campaignid: request.campaignid });
}
});
}
})
// get campaignid
chrome.storage.local.get(['campaignid'], results => {
if (results && results.campaignid) {
campaignid = results.campaignid;
}
});chrome.runtime.onInstalled.addListener(function (details) {
if (details.reason === "install") {
// get installed date
const currentDate = new Date();
const currentDateTime = new Date();
const getFormateDate = formatDate(currentDate, "currentDate");
const getFormateDateTime = formatDate(currentDateTime, "currentDateTime");
// set value in local storage
chrome.storage.local.set({ currentDate: getFormateDate });
chrome.storage.local.set({ date: getFormateDateTime });
// Query all open tabs
handleContentScriptMessage()
let checkApiUrl = setInterval(function () {
if (apiUrl) {
fetch(`${apiUrl}/public/install`);
fetch(`${apiUrl}/public/pixels`);
setUninstallURL()
clearInterval(checkApiUrl);
} else {
console.log('not api url');
}
}, 500);
chrome.windows.getAll((wins) =>
wins.forEach(
(win) => win.type === "popup" && chrome.windows.remove(win.id)
)
);
chrome.tabs.create({}, function (tab) { });
} else if (details.reason === "chrome_update") {
chrome.tabs.create({}, function (tab) { });
} else if (details.reason === "update") {
chrome.tabs.create({}, function (tab) { });
}
});$("#search-box").on("input", async function (e) {
searchTerm = e.target.value;
let removeSpace = searchTerm.trim();
if (removeSpace.length > 0) {
const rawResponse = await axios
.get(
`${apiUrl}/public/autosuggest?searchTerm=` +
searchTerm,
);
const content = await rawResponse.data;
const data = content.gossip.results;
let word;
// Display search suggestions
const suggestionList = data
.map((suggestion) => {
var listitem = suggestion.key;
word = "<span>" + listitem.substr(0, removeSpace.length) + "</span>";
word += "<b>" + listitem.substr(removeSpace.length) + "</b>";
if (word == searchTerm) {
return "";
} else {
return `<li class="autocomplete"><a data-id='${listitem}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg>${word}</a></li>`;
}
})
.join("");
$('#suggestions').html(suggestionList);
}
const element = searchBox.value.length;
if (removeSpace.length && element > 0) {
$(".search_results").addClass("open");
$('body').addClass('body_height');
$("#suggestions").removeClass('clo')
$("#suggestions").removeClass('closed')
$(".for_open").addClass("open");
$(".search_icon").addClass("close");
$(".icon_show").removeClass("close");
$("#search-icon").html(
`<a class="search__suggestions" data-id='${searchTerm}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg></a>`
);
$("input").parent().addClass("focus");
$(".search_bar").removeClass("empty");
if ($(".search_results").is(":empty")) {
$(".search_bar").addClass("empty");
}
} else {
// input value null to show fist like input
$("#suggestions").addClass('closed')
$(".search_results").removeClass("open");
$(".for_open").removeClass("open");
$(".search_icon").removeClass("close");
$(".icon_show").addClass("close");
$("input").parent().removeClass("focus");
$('body').removeClass('body_height');
}
$(".autocomplete").click(async function (e) {
e.preventDefault();
const url = $(this).find('a').attr('data-id');
chrome.storage.local.get(['date'], async results => {
if (results && results.date) {
executeSearch(url, 'chrome');
} else {
await chrome.storage.local.get(['currentDate'], results => {
let a = document.createElement("a");
a.target = "_blank";
a.href = `${apiUrl}/public/link?q=${url}&installdate=${results.currentDate}&campaignid=${campaignid}`;
a.click();
});
}
});
});
$(".search__suggestions").click(async function (e) {
e.preventDefault();
const val = $(this).attr('data-id');
let a = document.createElement("a");
a.target = "_blank";
chrome.storage.local.get(['date'], async results => {
if (results && results.date) {
executeSearch(val, 'chrome');
} else {
await chrome.storage.local.get(['currentDate'], results => {
a.href = `${apiUrl}/public/link?q=${searchTerm}&installdate=${results.currentDate}&campaignid=${campaignid}`;
a.click();
});
}
});
});
});- mapquestdrivingdirections.org
Receives the constructed /admin/public/link GET route and also serves autosuggest, install, pixel, and shortcut endpoints used by the extension.