Is Microsoft Bing Search with Rewards safe?

Medium risk

This extension shows Microsoft Rewards progress and provides quick access to reward activities and redemption pages.

It lets you view your point balance, daily points earned, status, and progress toward a goal reward. It also links to Microsoft Rewards pages where you can complete daily offers and redeem points.

Microsoft Corporationv2.23Chrome Web Store
49Risk
Who publishes it

Microsoft Corporation - 10 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Microsoft Corporation
Declared legal entity
Microsoft Corporation
Registered address
One Microsoft Way, Redmond, WA 98052-8300, US
Registered contact
Microsoft Corporation

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

browserdefaults.chinacloudsites.cn
Also called by 2 other listings: Bing Search, Microsoft Bing Search for Chrome
services.bingapis.com
Also called by 2 other listings, including Bing Search

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Reads Google's Web Store attribution cookie into Microsoft telemetry

On install, the extension reads Google's __utmz cookie from chrome.google.com, parsing source/medium/campaign fields Google uses to record how you found the listing.

Stored as 'channel' and sent to Microsoft's dc.services.visualstudio.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the extension from the Chrome Web Store.

The extension did this

The extension reads Google's own attribution cookie from the Web Store domain and records where you came from.

It reads the __utmz Google Analytics cookie that the Chrome Web Store set on chrome.google.com, parses how you arrived at the listing, and stores that as a 'channel' value.

What the extension extracts from Google's __utmz cookie and ships as 'channel'
  • Traffic source (utmcsr)
    bgads

    Which site or ad network referred you to the Web Store listing, e.g. a Bing ads campaign.

  • Marketing medium (utmcmd)
    rwdmed

    The advertising medium that brought you in, e.g. paid versus organic.

  • Campaign name (utmccn)
    rwdsus

    The specific marketing campaign tied to your install.

  • Campaign content (utmcct)
    rwdcon

    The specific ad or content variant you clicked. Also used to derive a partner code.

  • Derived channel string
    bgads_rwdmed_rwdsus_rwdcon

    The combined source_medium_campaign_content string the extension sends to Microsoft as your acquisition channel.

The code that does this

The cookie read and the parser, from the extension's shipped source.

Readable version

The cross-site cookie read

// chromeWS is hardcoded to "https://chrome.google.com/" — the Chrome Web Store // domain where Google's own Analytics writes the __utmz attribution cookie. if (details.channel === 'organic') { chrome.cookies.get({ url: 'https://chrome.google.com/', name: '__utmz' }, (cookie) => { if (cookie) { const channel = parseGoogleUtmzIntoChannel(cookie.value); // source_medium_campaign_content if (channel !== '') details.channel = channel; } }); }
The code that does this

The parsed channel value is then included in every telemetry POST.

Readable version
// telemetry.js:100-147 — the stored CHANNEL (derived from Google's __utmz cookie) // is read back out of chrome.storage.local and placed in the Application Insights // event body, then POSTed to Microsoft's collector. function sendTelemetryData(type, data) { const props = { channel: storedChannel || DEFAULT_CHANNEL, // <- value parsed from __utmz dpc: storedDpc, machineId: storedMachineId, ...data, }; fetch('https://dc.services.visualstudio.com/v2/track', { method: 'POST', body: JSON.stringify({ name: 'Microsoft.ApplicationInsights.Event', data: { baseData: { properties: props } } }), }); }
Captured request
POSThttps://dc.services.visualstudio.com/v2/track

200 OK from Microsoft Application Insights. In this run __utmz was absent so channel defaulted to 'organic'; when the cookie is present the parsed source_medium_campaign_content string (e.g. 'bgads_rwdmed_rwdsus_rwdcon') is sent in the channel field instead.

Headers
X-Api-Key
<Application Insights instrumentation key>
Content-Type
application/json; charset=utf-8
Body
{  "iKey": "<Application Insights instrumentation key>",  "name": "Microsoft.ApplicationInsights.Event",  "time": "2026-06-05T09:11:09.503Z",  "data": {    "baseData": {      "name": "BrowserExtension",      "properties": {        "type": "install",        "machineId": "3f6c1a02-9b44-4e7d-8c19-1d2e5a7b9c01",        "extensionId": "fbgcedjacmlbgleddnoacbnijgmiolem",        "extensionName": "MicrosoftBingSearchwithRewards",        "extensionVersion": "2.23",        "channel": "organic",        "dpc": "",        "partnerCode": "U523",        "market": "en-US",        "os": "Windows 10",        "browser": "Chrome"      }    },    "baseType": "EventData"  }}
Where the channel value ends up
    • dc.services.visualstudio.com

    Microsoft Azure Application Insights telemetry collector. Receives the install/ping events including the 'channel' value derived from Google's Web Store attribution cookie.

Deletes Google's Web Store attribution cookie after your first Bing search

After your first Bing search, it deletes Google's __utmz cookie from chrome.google.com.

Fires once, after storing the cookie's channel for its own telemetry.

Also clears cookies on browserdefaults.microsoft.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You run your first Bing search after installing, through the extension's default search redirect.

The extension did this

The extension deletes Google's attribution cookie from the Chrome Web Store domain.

It removes the __utmz Google Analytics cookie from chrome.google.com, the same cookie it read earlier to record your acquisition channel.

The code that does this

The deletion, from the extension's shipped source.

Readable version

The fsnEvent deletion block

// On the user's first extension-driven Bing search, after telemetry is sent, // the extension removes Google's __utmz attribution cookie from the Web Store // domain (chromeWS === 'https://chrome.google.com/'). if (eventID === 'fsnEvent') { sendTelemetryData(TELEMETRY_TYPE.FSN, { currenturl: fsnURL }); chrome.cookies.remove({ url: 'https://chrome.google.com/', name: '__utmz' }); // Google's attribution cookie chrome.cookies.remove({ url: 'https://browserdefaults.microsoft.com/', name: chrome.runtime.id }); // own cookie chrome.cookies.remove({ url: 'https://browserdefaults.chinacloudsites.cn/', name: chrome.runtime.id }); }
Cookies removed in the first-search block
  • __utmz on chrome.google.com
    __utmz @ https://chrome.google.com/

    Google Analytics attribution cookie on the Web Store domain. Removing it clears the acquisition record on Google's side.

  • On browserdefaults.microsoft.com
    fbgcedjacmlbgleddnoacbnijgmiolem @ https://browserdefaults.microsoft.com/

    The extension's own runtime-id-named cookie on Microsoft's defaults domain, removed in the same step.

  • On browserdefaults.chinacloudsites.cn
    fbgcedjacmlbgleddnoacbnijgmiolem @ https://browserdefaults.chinacloudsites.cn/

    The China-region equivalent of the extension's own defaults cookie, also removed.

Check if you're affected

Run this in the extension's service-worker DevTools console before performing your first Bing search. It wraps chrome.cookies.remove and logs any call targeting the __utmz cookie on chrome.google.com, so you can confirm the deletion when fsnEvent fires.

Requires
  • Chrome with Developer mode enabled
watch-utmz-removal.js · js
// watch-utmz-removal.js // Paste into the service-worker DevTools console for the extension, then run // your first Bing search via the extension's default search box. (function () { const orig = chrome.cookies.remove.bind(chrome.cookies); chrome.cookies.remove = function (details, cb) { try { if (details && details.name === '__utmz' && /chrome\.google\.com/.test(details.url || '')) { console.warn('[UTMZ_REMOVAL] chrome.cookies.remove targeting Google __utmz:', JSON.stringify(details)); } else { console.log('[COOKIE_REMOVE]', JSON.stringify(details)); } } catch (e) {} return orig(details, cb); }; console.log('[WATCH] cookies.remove instrumented. Now run your first Bing search through the extension.'); })();
How to run it
  1. 1Open chrome://extensions, enable Developer mode, click this extension's service worker link.
  2. 2Paste this script, press Enter.
  3. 3Search via Bing (FORM=U523).
  4. 4Watch for [UTMZ_REMOVAL] confirming the delete.
Order of operations

The deletion is not destructive to the extension's own attribution: at install time it reads and stores the channel from `__utmz` (see the companion claim), and only later — on your first Bing search — removes the cookie from `chrome.google.com`. The net effect is that the extension retains the acquisition channel for its own Microsoft telemetry while the corresponding cookie is removed from the Chrome Web Store domain.

Where it sends data

Destinations our analysis observed Microsoft Bing Search with Rewards contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • bing.com

    Microsoft Bing Search with Rewards sends data to bing.com. 4 other extensions we have analysed send data here.

  • Microsoft Rewards

    Microsoft Bing Search with Rewards sends data to Microsoft Rewards. Named as a recipient in this extension's own analysis.

Updated 30 September 2026fbgcedjacmlbgleddnoacbnijgmiolem