Is MapQuest Directions safe?

Medium risk

MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.

Each keystroke in the new tab search box is sent to mapquestdrivingdirections.org as the user types. When a new tab opens, the extension fetches arbitrary HTML from the same server and renders it directly into the page without sanitization, allowing the server to control page content. Search result clicks may also be routed through a tracking redirect that includes the user's install date and campaign ID.

MapQuest Directionsv1.1.5Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search clicks routed with install date

MediumunwantedCWE-359Dynamic sandbox

On the alternative new-tab search branch, a click builds a GET to mapquestdrivingdirections.org/admin/public/link with the search value, install date, and campaign ID.

What actually happens

You did this

You click a search suggestion or submit a search from the extension's new tab page.

The extension did this

The extension builds a MapQuest-domain link that carries the search value with install and campaign metadata.

Query fields assembled by the click handlers

  • Clicked search value
    directions to airport (illustrative)

    Shows what you selected or typed in the extension's search box.

  • Install date
    2026-06-15 (illustrative)

    Ties the search click to when this browser installed the extension.

  • Campaign identifier
    mq_campaign_17 (illustrative)

    Can group your browser with the distribution campaign that supplied the identifier.

Captured request

GEThttps://mapquestdrivingdirections.org/admin/public/link

The code that does this

Search handlers construct the routed link

Readable version

Campaign identifier and API host setup

script.js
let apiUrl;let campaignid = "";chrome.storage.local.get(['apiUrl'], results => {  if (results && results.apiUrl) {    apiUrl = "https://mapquestdrivingdirections.org/admin2";    callForSetApiURL();  } else {    apiUrl = "https://mapquestdrivingdirections.org/admin";    callForSetApiURL();  }});chrome.runtime.onMessageExternal.addListener((request, sender, sendResponse) => {  if (request.apiUrlChange) {    apiUrl = "https://mapquestdrivingdirections.org/admin2";    getShortcutOnload(apiUrl);    callPixelFunc(apiUrl);    chrome.storage.local.set({ apiUrl: true });  }  if (request.campaignid) {    chrome.storage.local.get(['campaignid'], results => {      if (!results.campaignid) {        chrome.storage.local.set({ campaignid: request.campaignid });      }    });  }})// get campaignid chrome.storage.local.get(['campaignid'], results => {  if (results && results.campaignid) {    campaignid = results.campaignid;  }});

Install date storage

background.js
chrome.runtime.onInstalled.addListener(function (details) {  if (details.reason === "install") {    // get installed date     const currentDate = new Date();    const currentDateTime = new Date();    const getFormateDate = formatDate(currentDate, "currentDate");    const getFormateDateTime = formatDate(currentDateTime, "currentDateTime");    // set value in local storage    chrome.storage.local.set({ currentDate: getFormateDate });    chrome.storage.local.set({ date: getFormateDateTime });    // Query all open tabs    handleContentScriptMessage()    let checkApiUrl = setInterval(function () {      if (apiUrl) {        fetch(`${apiUrl}/public/install`);        fetch(`${apiUrl}/public/pixels`);        setUninstallURL()        clearInterval(checkApiUrl);      } else {        console.log('not api url');      }    }, 500);    chrome.windows.getAll((wins) =>      wins.forEach(        (win) => win.type === "popup" && chrome.windows.remove(win.id)      )    );    chrome.tabs.create({}, function (tab) { });  } else if (details.reason === "chrome_update") {    chrome.tabs.create({}, function (tab) { });  } else if (details.reason === "update") {    chrome.tabs.create({}, function (tab) { });  }});

Autocomplete click path

script.js
$("#search-box").on("input", async function (e) {  searchTerm = e.target.value;  let removeSpace = searchTerm.trim();  if (removeSpace.length > 0) {    const rawResponse = await axios      .get(        `${apiUrl}/public/autosuggest?searchTerm=` +        searchTerm,      );    const content = await rawResponse.data;    const data = content.gossip.results;    let word;    // Display search suggestions    const suggestionList = data      .map((suggestion) => {        var listitem = suggestion.key;        word = "<span>" + listitem.substr(0, removeSpace.length) + "</span>";        word += "<b>" + listitem.substr(removeSpace.length) + "</b>";        if (word == searchTerm) {          return "";        } else {          return `<li class="autocomplete"><a data-id='${listitem}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg>${word}</a></li>`;        }      })      .join("");    $('#suggestions').html(suggestionList);  }  const element = searchBox.value.length;  if (removeSpace.length && element > 0) {    $(".search_results").addClass("open");    $('body').addClass('body_height');    $("#suggestions").removeClass('clo')    $("#suggestions").removeClass('closed')    $(".for_open").addClass("open");    $(".search_icon").addClass("close");    $(".icon_show").removeClass("close");    $("#search-icon").html(      `<a class="search__suggestions" data-id='${searchTerm}'><svg width="16" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M416 208c0 45.9-14.9 88.3-40 122.7L502.6 457.4c12.5 12.5 12.5 32.8 0 45.3s-32.8 12.5-45.3 0L330.7 376c-34.4 25.2-76.8 40-122.7 40C93.1 416 0 322.9 0 208S93.1 0 208 0S416 93.1 416 208zM208 352a144 144 0 1 0 0-288 144 144 0 1 0 0 288z"/></svg></a>`    );    $("input").parent().addClass("focus");    $(".search_bar").removeClass("empty");    if ($(".search_results").is(":empty")) {      $(".search_bar").addClass("empty");    }  } else {    // input value null to show fist like input    $("#suggestions").addClass('closed')    $(".search_results").removeClass("open");    $(".for_open").removeClass("open");    $(".search_icon").removeClass("close");    $(".icon_show").addClass("close");    $("input").parent().removeClass("focus");    $('body').removeClass('body_height');  }  $(".autocomplete").click(async function (e) {    e.preventDefault();    const url = $(this).find('a').attr('data-id');    chrome.storage.local.get(['date'], async results => {      if (results && results.date) {        executeSearch(url, 'chrome');      } else {        await chrome.storage.local.get(['currentDate'], results => {          let a = document.createElement("a");          a.target = "_blank";          a.href = `${apiUrl}/public/link?q=${url}&installdate=${results.currentDate}&campaignid=${campaignid}`;          a.click();        });      }    });  });  $(".search__suggestions").click(async function (e) {    e.preventDefault();    const val = $(this).attr('data-id');    let a = document.createElement("a");    a.target = "_blank";    chrome.storage.local.get(['date'], async results => {      if (results && results.date) {        executeSearch(val, 'chrome');      } else {        await chrome.storage.local.get(['currentDate'], results => {          a.href = `${apiUrl}/public/link?q=${searchTerm}&installdate=${results.currentDate}&campaignid=${campaignid}`;          a.click();        });      }    });  });});

External hosts involved in this path

    • mapquestdrivingdirections.org

    Receives the constructed /admin/public/link GET route and also serves autosuggest, install, pixel, and shortcut endpoints used by the extension.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Run searches with your default search engine

    search

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed MapQuest Directions contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mapquestdrivingdirections.org

    MapQuest Directions sends data to mapquestdrivingdirections.org. No other extension we have analyzed sends data here.

Updated 30 September 2026ljocfgbodlhbdiiojpdnimkomffghman