Is My Horoscope Pro safe?

Medium risk

MyHoroscopePro is medium risk. Every new tab you open, the extension sends your screen resolution, display scaling, OS, browser, and tracking IDs to webinline-usage.streamesh.net. A separate beacon reports device details every 2 hours. Not disclosed in the listing.

myhoroscopeprov0.2.9Chrome Web Store
45Risk
Who publishes it

myhoroscopepro - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
myhoroscopepro
Website
www.myhoroscopepro.com/contact

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

sns-q-search-extensions-service-us-east-1-k8s-internal.seccint.com
Also called by 1 other listing: UpSearches

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

New-tab extension fingerprints your screen and sends it to an ad host

Every new tab you open, the extension sends your screen resolution, display scaling, OS, browser, and tracking IDs to webinline-usage.streamesh.net.

A separate beacon reports device details every 2 hours.

Not disclosed in the listing.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a new browser tab.

The extension replaces Chrome's default new-tab page, so this happens on every new tab.

The extension did this

The extension calculates your screen resolution and display scaling, then sends it to webinline-usage.streamesh.net along with your OS, browser, and tracking IDs.

The same identifiers are attached to further requests as you keep using the browser.

02EvidenceFIELD TABLE
Fields sent to webinline-usage.streamesh.net
FieldValueWhy it matters
Unique installation ID
UN1725364918203957A persistent ID generated on install lets every request from this browser be tied together.
Session ID
550e8400-e29b-41d4-a716-446655440000A fresh ID per browsing session links your new-tab activity into one profile.
Screen resolution and DPI scaling
1536 * 864 @ 1.25xCombined with your browser and OS version, this narrows down the exact device you use.
Browser and OS version
Chrome 128 on Windows 10 64-bitIdentifies your exact software configuration, another fingerprinting input.
Google Click ID (gclid)
Cj0KCQiA1eyrBhDDARIsAKKdWaZLinks this install to the ad click that led to it, when present.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://webinline-usage.streamesh.net/
204 No Content
Body
jd={"GID":"SY1002541","ISID":"550e8400-e29b-41d4-a716-446655440000","event_type":"OpenThankYouPage","tracking":"","installeddate":"1725220000000","ext_name":"MyHoroscopePro","BrowserName":"Chrome","BrowserVersion":"128","gclid":"","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}
04EvidenceTEMPORAL PATTERN
When this fires
Every 2 hours

Every 2 hours, the background service worker sends a keep-alive beacon to i.myhoroscopepro.com with the extension version, user agent, and install date.

05EvidenceCODE COMPARE
The code that does this

The hardcoded telemetry endpoints and the function that posts to them

What it actually does
const consts = {
  USAGES_END_POINT: "https://webinline-usage.streamesh.net/",
  ALIVE_END_POINT: "https://i.myhoroscopepro.com",
  KEEP_ALIVE: { interval: 72e5 } // every 2 hours
};

async function alive(params, type, value, extra, offline) {
  if (value) {
    if (value !== 'Extension_Alive') {
      let dataU = {};
      for (const item in params) {
        if (!consts.INLINE_MAP[item]) continue;
        dataU[consts.INLINE_MAP[item]] = params[item];
      }
      dataU[type] = value;
      dataU.installedDate = await utils.storage.getItem('extension.installedDate');
      dataU.user_agent = navigator.userAgent;
      dataU.ext_version = chrome.runtime.getManifest().version;
      utils.post({...dataU, ...extra}, consts.USAGES_END_POINT, offline);
    }
    let last = await utils.storage.getItem('last_alive') || 0;
    let current = new Date().getTime();
    if (current - last > consts.KEEP_ALIVE.interval) {
      utils.storage.setItem('last_alive', current);
    } else {
      return;
    }
    let dataAlive = { action_type: 'Extension_Alive' };
    for (const item in params) {
      if (!consts.ALIVE_MAP[item]) continue;
      dataAlive[consts.ALIVE_MAP[item]] = params[item];
    }
    dataAlive.user_agent = navigator.userAgent;
    dataAlive.extension_version = chrome.runtime.getManifest().version;
    await utils.post({...dataAlive}, consts.ALIVE_END_POINT);
  }
}
06EvidenceTHIRD PARTY LIST
Where the data goes
  • webinline-usage.streamesh.net

    Receives the fingerprint and tracking payload, screen resolution, DPI, browser, OS, session and install IDs, on new-tab open and other tracked events.

  • i.myhoroscopepro.com

    The extension's own analytics subdomain; receives a keep-alive beacon every 2 hours with the extension version, user agent, and install date.

What it can do

Permissions this extension asks for, as declared in version 0.2.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on myhoroscopepro.com

    https://*.myhoroscopepro.com/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

Updated 30 September 2026ofoofdfligmnmnffdllcohgnkdiceede