Is Microsoft Bing InPrivate safe?
Microsoft Bing InPrivate sends a persistent machine ID and browser details to g.ceipmsn.com over HTTP.
The extension stores a machine ID locally and reuses it for Microsoft CEIP telemetry. On install, update, and a daily alarm, it sends that ID with the extension version, locale, Chrome version, extension ID, OS/user-agent-derived details, channel, and partner code to g.ceipmsn.com over cleartext HTTP.
Who publishes itMicrosoft Corporation - 9 other listings from the same operator, 1 of them carrying a finding
Microsoft Corporation - 9 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 23.3M+ users between them. 1 of them carries a finding.
Same operator - 3 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Microsoft Bing InPrivate sends a persistent device ID over plain HTTP
On install and every 24 hours after, the extension sends a persistent device ID and a browser fingerprint to Microsoft over plain, unencrypted HTTP.
Anyone on the network path can read every field in the request.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-319
- Source
- Dynamic sandbox
You install the extension, or simply leave it running for about a day.
No page visit or click is required; a recurring browser alarm does this on its own.
It sends a persistent device ID and browser fingerprint to Microsoft over unencrypted HTTP.
A coffee-shop Wi-Fi operator, your ISP, or any other network intermediary can read every field in the request.
Fire-and-forget: the extension does not read or act on the response body.
- Machine ID7307E460ADD9ED61AFC123D64D051763
A random ID generated once and reused forever, letting Microsoft link every future ping back to this specific device.
- Extension IDpjhcpooacdljimmmkpbknccbedoaagai
The unique identifier tying this ping to this specific extension install.
- Operating systemMacintosh;IntelMacOSX10_15_7
Your OS and platform string, parsed from the browser's user agent.
- Localeen-US
Your browser's display language.
- Browser versionChrome146.0.0.0
The exact Chrome build you're running.
- Extension version1.0.10
The exact extension build you're running.
serviceWorker.bundle.js: Ping.s(), Ping.o() and the DAILYPINGALARM handler
function sendPing(eventCode, market, partnerCode, channel, derivedPartnerCode, machineId) { var manifest = chrome.runtime.getManifest(); var extensionVersion = manifest.version; var uaParenStart = navigator.userAgent.indexOf("("); var uaParenEnd = navigator.userAgent.indexOf(")"); var osString = navigator.userAgent.substring(uaParenStart + 1, uaParenEnd).replace(/\s/g, ""); var locale = market || navigator.language; var url = "http://g.ceipmsn.com/8SE/44?"; var trackingVector = "TV=is" + (partnerCode || "U633") + "|pk" + manifest.name.replace(/ /g, "").replace("&", "and") + "|tm" + locale + "|bv" + navigator.userAgent.substr(navigator.userAgent.indexOf("Chrome")).split(" ")[0].replace("/", "") + "|ex" + chrome.runtime.id + "|es" + eventCode; if (channel) trackingVector += "|ch" + channel; if (derivedPartnerCode) trackingVector += "|dp" + derivedPartnerCode; url += "MI=" + machineId + "&LV=" + extensionVersion + "&OS=" + osString + "&TE=37&" + trackingVector; url = encodeURI(url); fetch(url); // plain http://, no TLS}function generateMachineId() { function hexChunk() { return Math.floor(65536 * (1 + Math.random())).toString(16).substring(1); } var id = hexChunk() + hexChunk() + hexChunk() + hexChunk() + hexChunk() + hexChunk() + hexChunk() + hexChunk(); return id.toLocaleUpperCase();}// Fired on install/update and roughly every 24 hours thereafterchrome.alarms.onAlarm.addListener(function (alarm) { if (alarm.name === "DAILYPINGALARM") { chrome.storage.local.get( ["pc", "bmkt", "machineId", "dpc", "channel"], function (stored) { sendPing("2", stored.bmkt, stored.pc, stored.channel, stored.dpc, stored.machineId); } ); }});- g.ceipmsn.com
Microsoft's CEIP (Customer Experience Improvement Program) telemetry collector; receives the device ID and fingerprint fields shown above, in cleartext.
What it can do
Permissions this extension asks for, as declared in version 1.0.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Change per-site browser settings such as cookies, JavaScript and camera access
contentSettings
See the address and title of every tab you have open
tabs
Read and change your full browsing history
history
Start, monitor and manage your downloads
downloads
Clear your browsing history, cache and cookies
browsingData
Change your browser's privacy and security settings
privacy
Block and redirect the requests your browser makes
declarativeNetRequest
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
Schedule its own background tasks
alarms
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Microsoft Bing InPrivate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- g.ceipmsn.com
Microsoft Bing InPrivate sends data to g.ceipmsn.com. 9 other extensions we have analysed send data here.