Is Microsoft Bing Homepage, Search & News safe?
Microsoft Bing Homepage, Search & News is medium risk. One minute after install, the extension reads every browser cookie, including auth and tracking cookies. It looks for PCCode/MachineID from Microsoft's installer; found values are stored, cookies deleted. Others are scanned, not stored.
Who publishes itMicrosoft Corporation - 10 other listings from the same operator, 2 of them carrying a finding
Microsoft Corporation - 10 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 4.6M+ users between them. 2 of them carry a finding.
Same operator - 3 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Broad cookie sweep reads all browser cookies at install
One minute after install, the extension reads every browser cookie, including auth and tracking cookies.
It looks for PCCode/MachineID from Microsoft's installer; found values are stored, cookies deleted.
Others are scanned, not stored.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install the extension from the Chrome Web Store.
No interaction is required, the behavior fires automatically one minute after installation.
The extension reads every cookie in your browser across all domains.
chrome.cookies.getAll({}) is called with an empty filter, enumerating cookies from every website you have ever visited.
On every browser startup
Fires once, approximately one minute after the first install, via chrome.alarms (ICE_BGALARM, delayInMinutes: 1). The alarm is only created when no existing alarm is found, and the cookie sweep only runs when the 'pc' storage key is absent, so it executes once on a fresh install.
Cookie sweep, full browser vs. targeted filter
// Narrower equivalent that only requests Microsoft-domain cookies:// chrome.cookies.getAll({ domain: 'microsoft.com' }, function (cookies) { ... })// Or by name:// chrome.cookies.getAll({ name: 'PCCode' }, callback)// chrome.cookies.getAll({ name: 'MachineID' }, callback)//// The shipped code passes an empty filter {}, which returns every cookie// accessible to the extension — not just microsoft.com cookies.- PC channel codeW000
A short code identifying which Microsoft product or channel brought you to this extension. Stored locally as the 'pc' key.
- Machine identifierA3F12C8E9D4B1E7F2A6C3D0E8B5F4A91
A persistent device identifier, copied from the Microsoft installer cookie or generated locally as a random GUID if absent.
Dynamic analysis (dynamic analysis) confirmed the full-browser getAll({}) call fires on a fresh install. The hook captured chrome.cookies.getAll with an empty filter at observed during dynamic analysis (background service worker). Console logs confirmed the 'Enter bg cookie logic — inside pc' branch executed. Only the PCCode and MachineID values were persisted to chrome.storage.local; no outbound network transmission of cookie data was observed during the dynamic analysis.
What it can do
Permissions this extension asks for, as declared in version 0.0.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on g.ceipmsn.com
http://g.ceipmsn.com/*
Read and change your data on bing.com
http://*.bing.com/* and 1 more
Read and change your data on microsoft.com
http://*.microsoft.com/* and 1 more
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Schedule its own background tasks
alarms