Is MySites safe?

Medium risk

MySites is medium risk. Searches from the MySites new tab page go to site.mysites-ext.com instead of your chosen engine. The URL carries your search terms plus a hardcoded affiliate ID. Not disclosed in the Store listing.…

Agile-Softv1.0.7Chrome Web Store
49Risk
Who publishes it

Agile-Soft - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Agile-Soft
Website
www.agile-soft.dev/index.html#subscribe

Same store account

1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.

Tropical Horizons Wallpapers10k+Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

allaboutdnt.com
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab searches are redirected to MySites with an affiliate tag.

Searches from the MySites new tab page go to site.mysites-ext.com instead of your chosen engine.

The URL carries your search terms plus a hardcoded affiliate ID.

Not disclosed in the Store listing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user submits a query from the new tab search form.

The extension did this

The extension redirects the search to site.mysites-ext.com with the query and tid=984811 in the URL.

Captured request
GEThttps://site.mysites-ext.com/?tid=984811
Fields in the request
  • Destination search URL
    https://site.mysites-ext.com/?tid=984811&q=weather (illustrative)

    Shows the remote search endpoint and fixed affiliate identifier used for the redirect.

  • Your search terms
    weather this weekend (illustrative)

    Carries the text entered into the new tab search box to the remote site.

Install ping to MySites attaches your existing site cookies

On install, MySites' background worker POSTs once to pxl.mysites-ext.com/thx with credentials included.

Any existing mysites-ext.com cookie attaches automatically, tying the install to that cookie.

Not disclosed in the listing or policy.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install MySites Extension from the Chrome Web Store.

This runs once, on the reason:'install' event only; it does not re-fire on later browser restarts or extension updates.

The extension did this

The extension sends a POST request to pxl.mysites-ext.com/thx with your browser set to attach any cookie it already holds for that domain.

The request uses fetch(url, {credentials:'include'}), so a pre-existing mysites-ext.com cookie, set by an earlier visit or affiliate redirect, is sent along automatically, without any prompt.

Captured request
POSThttps://pxl.mysites-ext.com/thx
Headers
Accept
application/json
Content-Type
application/json
Body
{  "extension_name": "MySites Extension"}
What's exposed to pxl.mysites-ext.com on install
  • mysites-ext.com cookie
    affid=3f7a1c9e-2b8d-4f61-9a05-7c8e1d2b3a4f (illustrative)

    Any existing mysites-ext.com cookie is attached automatically, since the request is sent with credentials:'include'.

  • Extension identifier
    extension_name: MySites Extension

    A fixed string naming the extension is sent in the request body.

  • Trigger condition
    chrome.runtime.onInstalled reason: install

    The request only fires once, immediately after the extension finishes installing.

The code that does this

Install listener, static/background/index.js

Readable version
chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason === "install") {    try {      console.log("install");      fetch("https://pxl.mysites-ext.com/thx", {        method: "POST",        credentials: "include",        headers: {          Accept: "application/json",          "Content-Type": "application/json"        },        body: JSON.stringify({          extension_name: "MySites Extension"        })      });    } catch (e) {      console.log(e);    }  }});
Destination
    • pxl.mysites-ext.com

    Receives the install-time ping and any mysites-ext.com cookie attached to it; used for install attribution tied to the MySites affiliate-search redirect network.

What it can do

Permissions this extension asks for, as declared in version 1.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mysites-ext.com

    *://*.mysites-ext.com/*

  • Read the sites you visit most

    topSites

Updated 30 September 2026neamblbbdhnjkjnddlhmlcmphidabmdp