Is MSN Homepage Plus safe?

Medium risk

MSN Homepage Plus is medium risk. MSN Homepage Plus GETs Microsoft's CEIP server (g.ceipmsn.com) on install, update, and tab activation, over HTTP, sending a persistent device UUID, OS/browser version, extension ID, Bing MUID cookie. Three requests captured in one session.

Microsoft Corporationv1.0.0.8Chrome Web Store
48Risk
Who publishes it

Microsoft Corporation - 10 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Microsoft Corporation
Declared legal entity
Microsoft Corporation
Registered address
One Microsoft Way, Redmond, WA 98052-8300, US
Registered contact
Microsoft Corporation

Same store account

7 other listings published from this account, 4.5M+ users between them. 3 of them carry a finding.

Microsoft Defender Browser Protection2.0M+CleanMSN + Bing for Chrome1.0M+MediumMSN Homepage700k+MediumMSN New Tab500k+LowBing Homepage, Search & Trending Topics100k+MediumMicrosoft Solitaire Collection with Search100k+Medium1 more listing in the relationship graph, on paid plans →

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Accessibility Insights for Web
same declared legal entity
100k+Clean2 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Persistent device ID and Bing cookie sent to Microsoft telemetry over HTTP

MSN Homepage Plus GETs Microsoft's CEIP server (g.ceipmsn.com) on install, update, and tab activation, over HTTP, sending a persistent device UUID, OS/browser version, extension ID, Bing MUID cookie.

Three requests captured in one session.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the extension, or open a new browser tab on a new day.

No explicit user consent step triggers the ping; it fires automatically on lifecycle events.

The extension did this

The extension sends your persistent device ID, OS fingerprint, browser version, and Bing tracking cookie to Microsoft's telemetry server over unencrypted HTTP.

The request goes to http://g.ceipmsn.com/8SE/44 with no HTTPS, making it readable to any network observer on the path.

Captured request
GEThttp://g.ceipmsn.com/8SE/44?MI=38F5E7198B832073D2D9131ECFAC7EBC&LV=1.0.0.8&OS=Macintosh;IntelMacOSX10_15_7&TE=37&TV=isUWDF%7CpkMSNHomepagePlus%7Ctmen-US%7CbvChrome/124.0.0.0%7CexfkkcgfBGOHBOIPDHLIAFMACJNHJBHMIM%7Ces3%7Cmu2AC8CFB370D06DBD1D14D89471B46C28
Parameters sent in every telemetry ping
  • Device ID (MI=)
    38F5E7198B832073D2D9131ECFAC7EBC

    A random UUID created on first run and stored permanently, letting the server track your device across sessions, even after cookies clear.

  • Bing tracking cookie (mu=)
    2AC8CFB370D06DBD1D14D89471B46C28

    The MUID cookie Microsoft set when you visited Bing. Linking it here ties your search identity to your browser installation.

  • OS fingerprint (OS=)
    Macintosh;IntelMacOSX10_15_7

    Your operating system and version, extracted from the browser's User-Agent string.

  • Browser version (bv=)
    Chrome/124.0.0.0

    Your Chrome version, contributing to a browser fingerprint.

  • Extension runtime ID (ex=)
    fkkcgfbgohboipdhliafmacjnhjbhmim

    The installed extension's Chrome runtime ID, confirming which version of the product you are running.

  • Event type (es=)
    3

    A status code indicating why this ping was sent: 1 = migration, 2 = daily, 3 = update.

The code that does this

SendPingDetails(), the function that assembles and fires the ping

Readable version
function SendPingDetails(status) {    chrome.storage.local.get(['pc', 'channel', 'MachineID', 'muid'], (items) => {        var pc = items.pc == undefined || items.pc == "" || items.pc == null ? "UWDF" : items.pc;        // If no MachineID exists, guid() generates a new UUID and persists it        var MachineID = (items.MachineID == undefined || items.MachineID == "" || items.MachineID == null)            ? guid() : items.MachineID;        var pingURL = 'http://g.ceipmsn.com/8SE/44?';  // plaintext HTTP, no TLS        var tVData = 'TV=is' + pc + '|pk' + ExtensionName + '|tm' + browserLanguage                   + '|bv' + BrowserVersion + '|ex' + ExtensionId + '|es' + status;        if (items.channel) tVData = tVData + "|ch" + items.channel;        if (items.muid)    tVData = tVData + "|mu" + items.muid;  // appends Bing MUID cookie        pingURL = pingURL + 'MI=' + MachineID + '&LV=' + ExtensionVersion + '&OS=' + OS + '&TE=37&' + tVData;        fetch(pingURL);  // fire-and-forget GET    });}
When this fires

On every browser startup

Pings fire on install (status=3 or 1), then daily on tab activation (status=2) after the 1.25-minute alarm elapses. The alarm is re-created each time the service worker starts, ensuring the ping survives browser restarts.

Where the telemetry data is sent
    • g.ceipmsn.com

    Microsoft Customer Experience Improvement Program endpoint. Receives the full fingerprint bundle (device UUID, OS, browser version, Bing MUID) over unencrypted HTTP.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on g.ceipmsn.com

    http://g.ceipmsn.com/*

  • Read and change your data on bing.com

    https://*.bing.com/* and 1 more

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

Updated 30 September 2026fkkcgfbgohboipdhliafmacjnhjbhmim