Is Microsoft Bing Search with Rewards safe?
This extension shows Microsoft Rewards progress and provides quick access to reward activities and redemption pages.
It lets you view your point balance, daily points earned, status, and progress toward a goal reward. It also links to Microsoft Rewards pages where you can complete daily offers and redeem points.
Who publishes itMicrosoft Corporation - 10 other listings from the same operator, 2 of them carrying a finding
Microsoft Corporation - 10 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 1.7M+ users between them. 2 of them carry a finding.
Same operator - 3 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Reads Google's Web Store attribution cookie into Microsoft telemetry
On install, the extension reads Google's __utmz cookie from chrome.google.com, parsing source/medium/campaign fields Google uses to record how you found the listing.
Stored as 'channel' and sent to Microsoft's dc.services.visualstudio.com.
You install the extension from the Chrome Web Store.
The extension reads Google's own attribution cookie from the Web Store domain and records where you came from.
It reads the __utmz Google Analytics cookie that the Chrome Web Store set on chrome.google.com, parses how you arrived at the listing, and stores that as a 'channel' value.
| Field | Value | Why it matters | |
|---|---|---|---|
Traffic source (utmcsr) | bgads | Which site or ad network referred you to the Web Store listing, e.g. a Bing ads campaign. | |
Marketing medium (utmcmd) | rwdmed | The advertising medium that brought you in, e.g. paid versus organic. | |
Campaign name (utmccn) | rwdsus | The specific marketing campaign tied to your install. | |
Campaign content (utmcct) | rwdcon | The specific ad or content variant you clicked. Also used to derive a partner code. | |
Derived channel string | bgads_rwdmed_rwdsus_rwdcon | The combined source_medium_campaign_content string the extension sends to Microsoft as your acquisition channel. |
The cookie read and the parser, from the extension's shipped source.
// chromeWS is hardcoded to "https://chrome.google.com/" — the Chrome Web Store // domain where Google's own Analytics writes the __utmz attribution cookie. if (details.channel === 'organic') { chrome.cookies.get({ url: 'https://chrome.google.com/', name: '__utmz' }, (cookie) => { if (cookie) { const channel = parseGoogleUtmzIntoChannel(cookie.value); // source_medium_campaign_content if (channel !== '') details.channel = channel; } }); }The parsed channel value is then included in every telemetry POST.
// telemetry.js:100-147 — the stored CHANNEL (derived from Google's __utmz cookie) // is read back out of chrome.storage.local and placed in the Application Insights // event body, then POSTed to Microsoft's collector. function sendTelemetryData(type, data) { const props = { channel: storedChannel || DEFAULT_CHANNEL, // <- value parsed from __utmz dpc: storedDpc, machineId: storedMachineId, ...data, }; fetch('https://dc.services.visualstudio.com/v2/track', { method: 'POST', body: JSON.stringify({ name: 'Microsoft.ApplicationInsights.Event', data: { baseData: { properties: props } } }), }); }| X-Api-Key | <Application Insights instrumentation key> |
| Content-Type | application/json; charset=utf-8 |
{
"iKey": "<Application Insights instrumentation key>",
"name": "Microsoft.ApplicationInsights.Event",
"time": "2026-06-05T09:11:09.503Z",
"data": {
"baseData": {
"name": "BrowserExtension",
"properties": {
"type": "install",
"machineId": "3f6c1a02-9b44-4e7d-8c19-1d2e5a7b9c01",
"extensionId": "fbgcedjacmlbgleddnoacbnijgmiolem",
"extensionName": "MicrosoftBingSearchwithRewards",
"extensionVersion": "2.23",
"channel": "organic",
"dpc": "",
"partnerCode": "U523",
"market": "en-US",
"os": "Windows 10",
"browser": "Chrome"
}
},
"baseType": "EventData"
}
}- dc.services.visualstudio.com
Microsoft Azure Application Insights telemetry collector. Receives the install/ping events including the 'channel' value derived from Google's Web Store attribution cookie.
Deletes Google's Web Store attribution cookie after your first Bing search
After your first Bing search, it deletes Google's __utmz cookie from chrome.google.com.
Fires once, after storing the cookie's channel for its own telemetry.
Also clears cookies on browserdefaults.microsoft.com.
You run your first Bing search after installing, through the extension's default search redirect.
The extension deletes Google's attribution cookie from the Chrome Web Store domain.
It removes the __utmz Google Analytics cookie from chrome.google.com, the same cookie it read earlier to record your acquisition channel.
The deletion, from the extension's shipped source.
// On the user's first extension-driven Bing search, after telemetry is sent, // the extension removes Google's __utmz attribution cookie from the Web Store // domain (chromeWS === 'https://chrome.google.com/'). if (eventID === 'fsnEvent') { sendTelemetryData(TELEMETRY_TYPE.FSN, { currenturl: fsnURL }); chrome.cookies.remove({ url: 'https://chrome.google.com/', name: '__utmz' }); // Google's attribution cookie chrome.cookies.remove({ url: 'https://browserdefaults.microsoft.com/', name: chrome.runtime.id }); // own cookie chrome.cookies.remove({ url: 'https://browserdefaults.chinacloudsites.cn/', name: chrome.runtime.id }); }| Field | Value | Why it matters | |
|---|---|---|---|
__utmz on chrome.google.com | __utmz @ https://chrome.google.com/ | Google Analytics attribution cookie on the Web Store domain. Removing it clears the acquisition record on Google's side. | |
On browserdefaults.microsoft.com | fbgcedjacmlbgleddnoacbnijgmiolem @ https://browserdefaults.microsoft.com/ | The extension's own runtime-id-named cookie on Microsoft's defaults domain, removed in the same step. | |
On browserdefaults.chinacloudsites.cn | fbgcedjacmlbgleddnoacbnijgmiolem @ https://browserdefaults.chinacloudsites.cn/ | The China-region equivalent of the extension's own defaults cookie, also removed. |
Run this in the extension's service-worker DevTools console before performing your first Bing search. It wraps chrome.cookies.remove and logs any call targeting the __utmz cookie on chrome.google.com, so you can confirm the deletion when fsnEvent fires.
// watch-utmz-removal.js // Paste into the service-worker DevTools console for the extension, then run // your first Bing search via the extension's default search box. (function () { const orig = chrome.cookies.remove.bind(chrome.cookies); chrome.cookies.remove = function (details, cb) { try { if (details && details.name === '__utmz' && /chrome\.google\.com/.test(details.url || '')) { console.warn('[UTMZ_REMOVAL] chrome.cookies.remove targeting Google __utmz:', JSON.stringify(details)); } else { console.log('[COOKIE_REMOVE]', JSON.stringify(details)); } } catch (e) {} return orig(details, cb); }; console.log('[WATCH] cookies.remove instrumented. Now run your first Bing search through the extension.'); })();- 1Open chrome://extensions, enable Developer mode, click this extension's service worker link.
- 2Paste this script, press Enter.
- 3Search via Bing (FORM=U523).
- 4Watch for [UTMZ_REMOVAL] confirming the delete.
The deletion is not destructive to the extension's own attribution: at install time it reads and stores the channel from `__utmz` (see the companion claim), and only later — on your first Bing search — removes the cookie from `chrome.google.com`. The net effect is that the extension retains the acquisition channel for its own Microsoft telemetry while the corresponding cookie is removed from the Chrome Web Store domain.
Where it sends data
Destinations our analysis observed Microsoft Bing Search with Rewards contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- bing.com
Microsoft Bing Search with Rewards sends data to bing.com. 4 other extensions we have analysed send data here.
- Microsoft Rewards
Microsoft Bing Search with Rewards sends data to Microsoft Rewards. Named as a recipient in this extension's own analysis.