Is Microsoft Bing Search with Rewards safe?

Question

Accepted Answer

Microsoft Bing Search with Rewards is medium risk. When you install this extension, it reads Google's __utmz Analytics cookie from chrome.google.com — the Chrome Web Store's own domain — and parses out the marketing source, medium, campaign, and content fields that Google sets to record how you found the listing. Dynamic analysis confirmed the read happens at startup, the parsed result is stored as a 'channel' value, and that value is included in install and ping telemetry POSTed to dc.services.visualstudio.com (Microsoft Application Insights). In the captured run the cookie was absent, so the channel defaulted to 'organic'; when the cookie is present, the source/medium/campaign string is sent instead, letting Microsoft reconstruct the Google-side acquisition attribution for each install. After you run your first Bing search through this extension's default search redirect, the extension deletes Google's __utmz Analytics cookie from chrome.google.com — the Chrome Web Store's own domain. Dynamic analysis confirmed the deletion fires once, gated on the 'first search notification' event, after the extension has already read and stored the acquisition channel from that cookie for its own telemetry. Removing __utmz from the Web Store domain clears the attribution data Google's Analytics would otherwise use to record how the install was acquired. The same code block also removes the extension's own cookies from browserdefaults.microsoft.com.

Is Microsoft Bing Search with Rewards safe?

Findings