Is MSN + Bing for Chrome safe?

Medium risk

MSN + Bing for Chrome is medium risk. On install, MSN + Bing's worker generates a persistent machine ID, sending it to Microsoft with partner/channel code, versions, OS and locale, before any interaction. The ID recurs on later pings, tying reports to one install; undisclosed.

Microsoft Corporationv1.0.0.57Chrome Web Store
49Risk
Who publishes it

Microsoft Corporation - 10 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Microsoft Corporation
Declared legal entity
Microsoft Corporation
Registered address
One Microsoft Way, Redmond, WA 98052-8300, US
Registered contact
Microsoft Corporation

Same store account

7 other listings published from this account, 3.5M+ users between them. 3 of them carry a finding.

Microsoft Defender Browser Protection2.0M+CleanMSN Homepage700k+MediumMSN New Tab500k+LowBing Homepage, Search & Trending Topics100k+MediumMicrosoft Solitaire Collection with Search100k+MediumMSN Homepage Plus50k+Medium1 more listing in the relationship graph, on paid plans →

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Accessibility Insights for Web
same declared legal entity
100k+Clean
Playwright Extension
same declared legal entity
100k+Clean
Storage Explorer
same declared legal entity
552Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Persistent machine ID and install metadata sent to Microsoft on install

On install, MSN + Bing's worker generates a persistent machine ID, sending it to Microsoft with partner/channel code, versions, OS and locale, before any interaction.

The ID recurs on later pings, tying reports to one install; undisclosed.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the extension.

No further interaction is required.

The extension did this

The extension generates a persistent machine ID and posts it, along with your install channel and device details, to a Microsoft telemetry endpoint.

This happens automatically on the install event, and again on a daily alarm and on every update.

Data confirmed in the outbound request to Microsoft during dynamic analysis
  • Machine ID
    DCEF8D0EAB675C524841B4DA846BCE93

    A persistent random ID the extension generates and reuses each report, letting Microsoft tie reports to one install over time.

  • Partner / install code
    U519

    A code identifying how and through which partner the extension was distributed to you.

  • Install channel
    organic

    How the install was acquired (for example organic versus an advertising channel).

  • Extension version
    1.0.0.57

    The installed version of the extension.

  • Extension ID
    jhikancdgcieieaapcjmbpjflikjgkpn

    The Chrome Web Store identifier of this extension.

  • Browser and OS
    Chrome/148.0.0.0, Linux

    Your browser name and version and operating system, which add to a device profile.

  • Locale and time zone
    en-US, en_US, +00:00

    Your language, market, and time-zone offset.

Captured request
POSThttps://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application/bond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-JS-1.8.9&x-apikey=a387cfcf60114a43a7699f9fbb49289e-

Telemetry collector accepted the event. Request fired from the background service worker automatically on install with no user interaction.

Headers
content-type
application/bond-compact-binary
Body
bond-compact-binary payload (Microsoft Aria / 1DS event 'getextensionconfig'). Field-decoding the captured body yields: MachineID=DCEF8D0EAB675C524841B4DA846BCE93, PartnerCode=U519, Channel=organic, Version=1.0.0.57, ExtensionId=jhikancdgcieieaapcjmbpjflikjgkpn, DeviceInfo.BrowserName=Chrome/148.0.0.0, OsName=Linux, UserInfo.Language=en-US, Locale=en_US, TimeZone=+00:00.
The code that does this

Background script: generate a persistent machine ID, then send install metadata

Readable version

Machine ID generation

scripts/ping.js
function guid() {  function hex() {    return Math.floor(65536 * (1 + Math.random())).toString(16).substring(1);  }  let id = (hex() + hex() + hex() + hex() + hex() + hex() + hex() + hex()).toUpperCase();  chrome.storage.local.set({ MachineID: id });   // persisted, reused on every later ping  return id;}

Reads stored identifiers and sends them

scripts/ping.js
function SendPingDetails(pingType) {  const version = chrome.runtime.getManifest().version;  chrome.storage.local.get(["PartnerCode", "Channel", "MachineID", "DPC", "Market"], (s) => {    const market = s.Market || navigator.language;    let tags = "TV=is" + (s.PartnerCode || "U519") + "|pk" + extNameNoSpaces +              "|tm" + market + "|bv" + chromeVersion + "|ex" + extensionId + "|es" + pingType;    if (s.Channel) tags += "|ch" + s.Channel;    if (s.DPC)     tags += "|dp" + s.DPC;    // MI = persistent machine id, LV = extension version, OS = platform string    let payload = "MI=" + s.MachineID + "&LV=" + version + "&OS=" + osString + "&TE=37&" + tags;    let url = "https://go.microsoft.com/fwlink/?linkid=2243942&UD=" + btoa(encodeURI(payload)) + "&ver=2";    fetch(encodeURI(url));   // the Aria/1DS telemetry POST carries the same identifiers  });}

First ping fires on install, then daily

scripts/ping.js
chrome.runtime.onInstalled.addListener((details) => {  if (details.reason === "install") {    getBrowserDefaultDetails("organic").then(() => {      chrome.alarms.create("JHI_DAILYPINGALARM", { delayInMinutes: 1, periodInMinutes: 1440 });      SendPingDetails("1");   // '1' = install ping, no user interaction required    });  } else if (details.reason === "update") {    // schedules SendPingDetails('3') on the update path  }});chrome.alarms.onAlarm.addListener((a) => {  if (a.name === "JHI_DAILYPINGALARM") SendPingDetails("2");   // '2' = daily ping});
Why you can't catch this in DevTools

The go.microsoft.com ping packs its payload into a base64 string under the UD parameter, so the identifiers are not visible in the raw URL. Decoding the base64 shows the persistent machine ID and device metadata in plaintext.

Decoded value
MI=DCEF8D0EAB675C524841B4DA846BCE93&LV=1.0.0.57&OS=X11;Linux;x86_64&TE=37&TV=isU519|pkMSNandBingforChrome|tmen-US|bv148|exjhikancdgcieieaapcjmbpjflikjgkpn|es1|chorganic
Where the telemetry is sent
    • browser.pipe.aria.microsoft.com

    Microsoft Aria / 1DS telemetry collector (Microsoft-owned). Received the bond-compact-binary event carrying the persistent machine ID and device/install metadata on install.

    • go.microsoft.com

    Microsoft forwarding-link service (Microsoft-owned). The SendPingDetails ping (linkid=2243942) carries the same identifiers base64-encoded in the UD query parameter.

Check if you're affected

Decodes the base64 UD parameter from an MSN + Bing for Chrome telemetry ping URL so you can read the machine ID and metadata that were sent.

Requires
  • Node.js 18+
decode_msn_ping.js · js
// Usage: node decode_msn_ping.js "<full go.microsoft.com fwlink URL>"// Reads the UD query parameter, base64-decodes it, and prints the fields.const input = process.argv[2];if (!input) {  console.error("Pass the full ping URL (the go.microsoft.com/fwlink/?...UD=... link).");  process.exit(1);}const u = new URL(input);const ud = u.searchParams.get("UD");if (!ud) {  console.error("No UD parameter found in URL.");  process.exit(1);}const decoded = decodeURIComponent(Buffer.from(ud, "base64").toString("utf8"));console.log("Decoded payload:\n" + decoded + "\n");const params = new URLSearchParams(decoded.replace(/\|/g, "&"));for (const [k, v] of params) {  console.log(k + " = " + v);}console.log("\nMI is the persistent machine ID reused across pings.");
How to run it
  1. 1Install Node.js 18+.
  2. 2Capture a request to go.microsoft.com/fwlink/?linkid=2243942 (network tools or a proxy).
  3. 3Run: node decode_msn_ping.js "<URL>".
  4. 4Read the printed MI (machine ID) and other fields.
Scope of what was confirmed

Dynamic analysis confirmed the persistent machine ID and the device/install metadata leaving the device to Microsoft infrastructure on install. The extension's source additionally reads a partner-code cookie from browserdefaults.microsoft.com and a Google analytics cookie (__utmz) to derive the install channel, but those cookie values and browsing history were not observed in the captured outbound bodies, so this finding is limited to the machine ID and metadata. The recipient is Microsoft-owned infrastructure; the behavior is not described in the Chrome Web Store listing.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.57. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See the address and title of every tab you have open

    tabs

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Add items to the right-click menu

    contextMenus

  • Show you desktop notifications

    notifications

Updated 30 September 2026jhikancdgcieieaapcjmbpjflikjgkpn