Is MSN Homepage & Bing Search Engine safe?

Medium risk

Sets the browser homepage to MSN.com and provides Bing as the search engine.

This extension sets the browser homepage to MSN.com for access to news, entertainment, and sports. It also turns browser searching into Bing search and adds a toolbar icon for quick access to MSN.com.

Microsoft Corporationv1.0.0.8Chrome Web Store
54Risk
Who publishes it

Microsoft Corporation - 10 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Microsoft Corporation
Declared legal entity
Microsoft Corporation
Registered address
One Microsoft Way, Redmond, WA 98052-8300, US
Registered contact
Microsoft Corporation

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

MSN ping: device fingerprint sent to Microsoft on install

About 75 seconds after install, MSN Homepage & Bing Search Engine sends a request to Microsoft's g.ceipmsn.com with a permanent device ID, extension version, OS, browser language/version, extension ID.

It repeats on updates and daily.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the MSN Homepage & Bing Search Engine extension.

The extension did this

About 75 seconds later the extension sends an HTTP request to g.ceipmsn.com, a Microsoft telemetry host, with a fresh device ID, OS, browser, language, and extension version.

The same request also fires on every extension update (status=3) and once per day on the first tab you activate (status=2).

Captured request
GEThttp://g.ceipmsn.com/8SE/44?MI=3163F655A3F5A39C68D771CFBB57F349&LV=1.0.0.8&OS=Macintosh;IntelMacOSX10_15_7&TE=37&TV=isUWDF%7cpkMSNHomepageandBingSearchEngine%7ctmen-GB%7cbvChrome146.0.0.0%7cexfcfenmboojpjinhpgggodefccipikbpd%7ces2%7cmu2AC8CFB370D06DBD1D14D89471B46C28

Microsoft endpoint typically replies with HTTP 200 and a 1x1 GIF or empty body, it's a beacon, not a content endpoint.

Headers
Host
g.ceipmsn.com
Accept
*/*
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept-Language
en-GB
What gets packed into the URL on every ping
  • MachineID (MI)
    3163F655A3F5A39C68D771CFBB57F349

    A 32-character GUID generated locally on install, stored forever in chrome.storage.local. Same value on every ping for the install's life.

  • Extension version (LV)
    1.0.0.8

    Which build of the MSN extension you have installed.

  • Operating system (OS)
    Macintosh;IntelMacOSX10_15_7

    Your OS name and version, parsed out of the User-Agent string.

  • Endpoint code (TE)
    37

    Hardcoded value 37, identifies this endpoint to the Microsoft CEIP collector.

  • Partner code (pc)
    UWDF

    Distribution / attribution code identifying who placed this extension on your machine. Defaults to 'UWDF'.

  • Extension name (pk)
    MSNHomepageandBingSearchEngine

    Hardcoded extension name with spaces stripped.

  • Browser language (tm)
    en-GB

    Your browser's UI language, narrows you down geographically and culturally.

  • Browser version (bv)
    Chrome146.0.0.0

    Browser brand and version, also extracted from the User-Agent.

  • Extension ID (ex)
    fcfenmboojpjinhpgggodefccipikbpd

    The Chrome Web Store ID of this extension.

  • Status code (es)
    2

    Why this ping fired: 1 = first-run migration, 2 = daily heartbeat, 3 = post-update.

The code that does this

The code that builds and fires the ping, straight from the shipping extension.

Readable version

The 75-second alarm

// On service-worker startup, schedule a one-shot alarm 1.25 minutes// out so we don't fire the ping during the install spike.const PING_ALARM = 'FCF_PINGALARM';chrome.alarms.get(PING_ALARM).then(alarm => {  if (!alarm) chrome.alarms.create(PING_ALARM, { delayInMinutes: 1.25 });});

The payload assembly + fetch

function SendPingDetails(status) {  chrome.storage.local.get(['pc', 'channel', 'MachineID', 'muid'], (items) => {    const pc        = items.pc        || 'UWDF';    const machineId = items.MachineID || guid();          // makes one if absent    let   tv        = `TV=is${pc}|pk${ExtensionName}|tm${browserLanguage}` +                      `|bv${BrowserVersion}|ex${ExtensionId}|es${status}`;    if (items.channel) tv += `|ch${items.channel}`;    if (items.muid)    tv += `|mu${items.muid}`;            // attach Bing identity    const url = `http://g.ceipmsn.com/8SE/44?MI=${machineId}` +                `&LV=${ExtensionVersion}&OS=${OS}&TE=37&${tv}`;    fetch(url.replace(/\|/g, '%7c').replace(/,/g, '%2c'));  });}
Where the ping ends up
    • g.ceipmsn.com

    Microsoft's CEIP telemetry collector, receives every ping. The '/8SE/' path is likely a per-product partition; 'ceip' is Microsoft's standard telemetry brand.

Reproduce it yourself

One-line tcpdump filter that captures the MSN extension's telemetry beacon as it leaves your machine. Confirms the ping is real and shows you exactly what is in it, without needing the extension's source.

Requires
  • macOS or Linux
  • tcpdump
  • sudo
  • Bing MUID cookie present in your browser to see the |mu... field
msn-ping-watcher.sh · sh
#!/usr/bin/env bash# msn-ping-watcher.sh — capture the MSN extension telemetry pingset -euo pipefailecho "[*] Watching for HTTP requests to g.ceipmsn.com on $(hostname)..."echo "[*] Install or reload the extension; ping fires ~75s later."# tcpdump on port 80, filter Host: g.ceipmsn.com, dump the URL linesudo tcpdump -i any -A -s 0 'tcp port 80' 2>/dev/null \  | grep -E -A1 "Host: g\.ceipmsn\.com" \  | grep -E "GET /8SE/" \  | sed 's/^/[CAPTURED] /'
How to run it
  1. 1Save as msn-ping-watcher.sh, chmod +x.
  2. 2Run: `sudo ./msn-ping-watcher.sh`.
  3. 3Open chrome://extensions, reload MSN, wait ~80s.
  4. 4Each GET is one ping leaving your machine; the URL holds your MachineID and the fields above.

Browser fingerprint plus Bing identity shipped to Microsoft CEIP

On install, update, and daily after, MSN sends Microsoft a device GUID, your OS/browser version, UI language, extension ID, a status code, and your Bing MUID cookie.

Combined, GUID+MUID give Microsoft a permanent join to your browsing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the extension, or simply leave it installed long enough for the daily heartbeat to fire.

The extension did this

The extension assembles a 10-field fingerprint that includes a permanent MachineID GUID and your Bing MUID cookie value, then ships it to Microsoft's CEIP collector.

The MachineID is the join key Microsoft can use to recognise you on every future ping; the MUID is the link to the rest of your Microsoft identity graph.

Captured request
GEThttp://g.ceipmsn.com/8SE/44?MI=3163F655A3F5A39C68D771CFBB57F349&LV=1.0.0.8&OS=Macintosh;IntelMacOSX10_15_7&TE=37&TV=isUWDF%7cpkMSNHomepageandBingSearchEngine%7ctmen-GB%7cbvChrome146.0.0.0%7cexfcfenmboojpjinhpgggodefccipikbpd%7ces2%7cmu2AC8CFB370D06DBD1D14D89471B46C28

Microsoft beacon endpoint, empty body, HTTP 200. The URL itself is the entire payload.

Headers
Host
g.ceipmsn.com
Accept
*/*
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept-Language
en-GB
Every field in the fingerprint, broken out
  • MachineID GUID (MI)
    3163F655A3F5A39C68D771CFBB57F349

    Permanent 32-char install ID (Math.random() GUID), stored forever locally. The key tying every ping to this device.

  • Bing MUID (mu)
    2AC8CFB370D06DBD1D14D89471B46C28

    Bing's cross-property identity cookie, copied from bing.com at install. Joins MachineID to your Bing/MSN/Outlook profile.

  • Extension ID (ex)
    fcfenmboojpjinhpgggodefccipikbpd

    Web Store ID of the extension itself, confirms which build is talking.

  • Extension version (LV)
    1.0.0.8

    Build number of the extension you have installed.

  • OS string (OS)
    Macintosh;IntelMacOSX10_15_7

    Parsed from the User-Agent's parenthesised platform block. Combination of OS family + version.

  • Browser version (bv)
    Chrome146.0.0.0

    Browser brand + version, also pulled from the User-Agent.

  • Browser language (tm)
    en-GB

    navigator.language, narrows you down regionally and culturally.

  • Partner code (pc)
    UWDF

    Distribution code identifying who placed this extension on your machine; defaults to UWDF.

  • Extension name (pk)
    MSNHomepageandBingSearchEngine

    Hardcoded short name of the extension.

  • Status code (es)
    2

    Why the ping fired. 1 = first-run migration, 2 = daily heartbeat, 3 = post-update.

  • Endpoint code (TE)
    37

    Hardcoded value identifying this CEIP product channel.

The code that does this

How the fingerprint is assembled, source straight from ping.js.

Readable version

Fingerprint inputs

// Pulled out of the User-Agent and chrome.runtime APIs at script-load time://   OS              — '(Macintosh; Intel Mac OS X 10_15_7)' → 'Macintosh;IntelMacOSX10_15_7'//   browserLanguage — 'en-GB'//   ExtensionName   — 'MSNHomepageandBingSearchEngine'//   ExtensionVersion— '1.0.0.8'//   ExtensionId     — 'fcfenmboojpjinhpgggodefccipikbpd'//   BrowserVersion  — 'Chrome146.0.0.0'const ua = navigator.userAgent;const OS = ua.slice(ua.indexOf('(')+1, ua.indexOf(')')).replace(/\s/g, '');const browserLanguage = navigator.language;const { name, version: ExtensionVersion } = chrome.runtime.getManifest();const ExtensionName = name.replace(/ /g,'').replace(/&/g,'and');const ExtensionId   = chrome.runtime.id;const parts = ua.split(' ');const BrowserVersion = parts[parts.length - 2].replace('/','');

Fingerprint + identity join + fetch

function SendPingDetails(status) {  chrome.storage.local.get(['pc','channel','MachineID','muid'], items => {    const pc        = items.pc        || 'UWDF';    const machineId = items.MachineID || guid();         // ← stable per-install join key    let   tv        = `TV=is${pc}|pk${ExtensionName}|tm${browserLanguage}` +                      `|bv${BrowserVersion}|ex${ExtensionId}|es${status}`;    if (items.channel) tv += `|ch${items.channel}`;    if (items.muid)    tv += `|mu${items.muid}`;          // ← Bing identity attached    const url = `http://g.ceipmsn.com/8SE/44?MI=${machineId}` +                `&LV=${ExtensionVersion}&OS=${OS}&TE=37&${tv}`;    fetch(url.replace(/\|/g,'%7c').replace(/,/g,'%2c'));  });}
Where the fingerprint is sent
    • g.ceipmsn.com

    Microsoft's Customer Experience Improvement Program (CEIP) collector. The /8SE/44 path is a per-product partition. Receives the full fingerprint and identity join on every ping.

Reproduce it yourself

Pretty-prints any captured MSN ceipmsn ping URL into its individual fields, so you can see what's in the fingerprint without parsing pipe-delimited query strings by eye.

Requires
  • Node.js 14+
msn-fingerprint-decoder.js · js
#!/usr/bin/env node// msn-fingerprint-decoder.js — decode a captured g.ceipmsn.com ping URL// Usage://   node msn-fingerprint-decoder.js 'http://g.ceipmsn.com/8SE/44?MI=...&TV=...'// Or pipe the URL on stdin://   pbpaste | node msn-fingerprint-decoder.jsfunction decode(rawUrl) {  const u = new URL(rawUrl);  const out = {};  for (const [k, v] of u.searchParams) {    if (k === 'TV') {      // TV is a pipe-delimited record where each token is      // {2-char field code}{value}, e.g. 'isUWDF', 'pkMSN...', 'mu2AC8...'      const tv = {};      v.split('|').forEach(token => {        const code = token.slice(0, 2);        const val  = token.slice(2);        tv[expandTvCode(code)] = val;      });      out['TV (decoded)'] = tv;    } else {      out[expandTopCode(k)] = v;    }  }  return out;}function expandTopCode(c) {  return ({    MI: 'MachineID (permanent device GUID)',    LV: 'ExtensionVersion',    OS: 'OperatingSystem',    TE: 'EndpointCode (hardcoded 37)',  })[c] || c;}function expandTvCode(c) {  return ({    is: 'PartnerCode (pc)',    pk: 'ExtensionName',    tm: 'BrowserLanguage',    bv: 'BrowserVersion',    ex: 'ExtensionId',    es: 'StatusCode (1=migration 2=daily 3=update)',    ch: 'Channel',    mu: 'BingMUIDcookie (cross-property identity)',  })[c] || c;}async function main() {  let raw = process.argv[2];  if (!raw) {    raw = await new Promise(res => {      let buf = '';      process.stdin.on('data', c => buf += c);      process.stdin.on('end', () => res(buf.trim()));    });  }  if (!raw) {    console.error('Pass a URL as arg or pipe one on stdin.');    process.exit(2);  }  console.log(JSON.stringify(decode(raw), null, 2));}main();
How to run it
  1. 1Capture an MSN ping URL with mitmproxy/Wireshark/tcpdump.
  2. 2Save as msn-fingerprint-decoder.js.
  3. 3Run `node msn-fingerprint-decoder.js 'http://g.ceipmsn.com/8SE/44?...'`.
  4. 4Output is labelled JSON of every field.

Daily MSN ping links your Bing MUID to a permanent device ID

Once a day, on your first active tab, the MSN extension pings Microsoft with your MachineID and Bing MUID cookie (read at install, stashed in storage) concatenated.

This ties your device to your Bing identity even if you sign out.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You switch to your first browser tab on a new day.

The extension did this

The MSN extension sends a ping to Microsoft that joins your permanent MachineID with your Bing MUID, the same MUID that Bing uses to recognise you across signed-out sessions.

If you've never been to bing.com (so no MUID exists), only the MachineID is sent. Once Bing sets a MUID for you, every future ping carries both.

The code that does this

How the MUID gets harvested at install time and replayed on every daily ping.

Readable version

Reading the Bing MUID cookie on install

// On extension install, sniff the Bing MUID cookie out of bing.com's// jar and copy it into our own storage — even though the user never// asked us to read their bing.com cookies.chrome.runtime.onInstalled.addListener(() => {  chrome.cookies.get({ url: 'https://www.bing.com/', name: 'MUID' }, cookie => {    if (cookie?.value) {      chrome.storage.local.set({ muid: cookie.value });    }  });});

Generating the permanent MachineID

// Build a 32-char hex GUID, write it to chrome.storage.local under 'MachineID',// and reuse the same value for the lifetime of the install. Math.random() is// not cryptographically strong but the value just needs to be unique per user.function guid() {  const s4 = () => Math.floor((1 + Math.random()) * 0x10000)                       .toString(16).substring(1);  const id = (s4()+s4()+s4()+s4()+s4()+s4()+s4()+s4()).toUpperCase();  chrome.storage.local.set({ MachineID: id });  return id;}

Daily ping reads both back and ships them

chrome.storage.local.get(['pc','channel','MachineID','muid'], items => {  const machineId = items.MachineID || guid();  let   tv        = `TV=is${items.pc||'UWDF'}|pk${ExtensionName}|tm${browserLanguage}` +                    `|bv${BrowserVersion}|ex${ExtensionId}|es${status}`;  if (items.muid) tv += `|mu${items.muid}`;        // ← Bing identity goes here  const url = `http://g.ceipmsn.com/8SE/44?MI=${machineId}` +    // ← MachineID here              `&LV=${ExtensionVersion}&OS=${OS}&TE=37&${tv}`;  fetch(url);});
The two persistent identifiers that get joined on every daily ping
  • MachineID GUID
    3163F655A3F5A39C68D771CFBB57F349

    32-char hex string generated on install, stored under 'MachineID', never rotated. Unique to your install, so every matching ping is yours.

  • Bing MUID cookie
    2AC8CFB370D06DBD1D14D89471B46C28

    Microsoft's cross-property identity cookie. Bing uses it to recognise you across bing.com, msn.com, outlook.com, even signed out.

Captured request
GEThttp://g.ceipmsn.com/8SE/44?MI=3163F655A3F5A39C68D771CFBB57F349&LV=1.0.0.8&OS=Macintosh;IntelMacOSX10_15_7&TE=37&TV=isUWDF%7cpkMSNHomepageandBingSearchEngine%7ctmen-GB%7cbvChrome146.0.0.0%7cexfcfenmboojpjinhpgggodefccipikbpd%7ces2%7cmu2AC8CFB370D06DBD1D14D89471B46C28

Microsoft beacon endpoint, typically returns 200 with no body. The request itself is the data delivery.

Headers
Host
g.ceipmsn.com
Accept
*/*
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
What's stored on your device

Keys driving the daily ping. MachineID/muid are persistent identifiers; PingDate is the watermark for the next ping. None appear in the UI.

Location
chrome.storage.local (extension fcfenmboojpjinhpgggodefccipikbpd)
Contents
{  "pc": "UWDF",  "muid": "2AC8CFB370D06DBD1D14D89471B46C28",  "PingDate": "Mon Apr 14 2026",  "MachineID": "3163F655A3F5A39C68D771CFBB57F349",  "ExtnVersion": "1.0.0.8",  "BingDefaultsSet": "done",  "DailyPingbyalarm": "true"}
Where the linked identifiers are sent
    • g.ceipmsn.com

    Microsoft's Customer Experience Improvement Program telemetry collector. Receives the joined MachineID + MUID daily.

    • bing.com

    Source of the MUID cookie. Microsoft-owned. The extension reads cookies from this domain at install time even though the user has not necessarily interacted with the extension yet.

Check if you're affected

Prints the persistent identifiers the MSN extension is keeping about you in your browser. Run from the extension's service-worker DevTools console.

Requires
  • Chrome with Developer mode enabled in chrome://extensions
  • MSN Homepage & Bing Search Engine extension installed
show-msn-tracking-keys.js · js
// show-msn-tracking-keys.js// Run from the MSN extension's service worker DevTools console://   chrome://extensions → Developer mode → click 'service worker' link// Pastes the keys this extension is hoarding about you and the// link it has built between your device and your Bing MUID.chrome.storage.local.get(  ['MachineID', 'muid', 'PingDate', 'pc', 'channel', 'ExtnVersion'],  items => {    console.group('[MSN-Bing extension] persistent identifiers');    console.log('MachineID (this device, forever):', items.MachineID || '(none)');    console.log('Bing MUID copy (your cross-MS identity):', items.muid || '(none)');    console.log('Last daily ping date:', items.PingDate || '(none)');    console.log('Partner code (pc):', items.pc || '(default UWDF)');    console.log('Channel:', items.channel || '(none)');    console.log('Extension version:', items.ExtnVersion || '(none)');    if (items.MachineID && items.muid) {      console.warn(        'Microsoft can join MI=' + items.MachineID +        ' to MUID=' + items.muid + ' on every daily ping.'      );    }    console.groupEnd();  });
How to run it
  1. 1Open chrome://extensions, enable Developer mode.
  2. 2Find 'MSN Homepage & Bing Search Engine', click 'service worker'.
  3. 3Paste the script into the Console, press Enter.
  4. 4Output shows the MachineID GUID and Bing MUID kept about you.

+2 more findings not shown

What it can do

Permissions this extension asks for, as declared in version 1.0.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on g.ceipmsn.com

    http://g.ceipmsn.com/*

  • Read and change your data on bing.com

    http://*.bing.com/* and 1 more

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed MSN Homepage contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • MSN.com

    MSN Homepage sends data to MSN.com. No other extension we have analysed sends data here.

  • Bing

    MSN Homepage sends data to Bing. Named as a recipient by 6 other extensions we have analysed.

Updated 30 September 2026fcfenmboojpjinhpgggodefccipikbpd