Mystique is medium risk. Opening Mystique features or searching its new-tab page requests mloeri.com/track/evt.php with feature name, extension ID, and stored install time/cohort. The request sends credentials, so mloeri.com cookies go too. No live path fired. Submitting a search in Mystique redirects to webresult.info/search.php before the chosen provider. The redirect carries the typed term, extension ID, and stored install time/cohort. No live request recorded; testing never typed in the box.

Mystique is published by App Studio. The same operator publishes 1 other store listing, none of which carry a security finding.

Is Mystique safe?

Medium risk

Mystique is medium risk. Opening Mystique features or searching its new-tab page requests mloeri.com/track/evt.php with feature name, extension ID, and stored install time/cohort. The request sends credentials, so mloeri.com cookies go too. No live path fired.…

App Studiov1.0.26Chrome Web Store

49Risk

Who publishes it

App Studio - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

App Studio

Same store account

1 other listing published from this account, 50k+ users between them, none of them carrying a finding.

Mystique Search50k+Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

ressourceapp.com

Also called by 1 other listing: PerfecTab

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Feature events sent to mloeri.com with cookies

Opening Mystique features or searching its new-tab page requests mloeri.com/track/evt.php with feature name, extension ID, and stored install time/cohort.

The request sends credentials, so mloeri.com cookies go too.

No live path fired.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

You open or use a Mystique feature in the new-tab page.

The code names forecast, quick links, top sites, options, news, notepad, to-do list, welcome, and search interactions.

The extension did this

Mystique prepares a tracking request to mloeri.com for that interaction.

The request includes the feature name and value, and one path also adds stored install and cohort values.

Fields prepared for the mloeri.com event request

Extension ID
edcdolejdklgjkjinjknidifilkpnmgn
Lets the destination associate the event with this installed Chrome extension.
Feature name
forecast
Shows which part of the extension you used.
Feature value
open
Adds detail about the interaction, such as opening a panel or clicking an option.
Install time
1713139200 (illustrative)
Can help connect multiple events back to the same extension install over time.
Cohort
default (illustrative)
Can group your install with a stored rollout or experiment value.
mloeri.com cookies
visitor_id=8f14e45fceea167a5a36dedd4bea2543 (illustrative)
If your browser has cookies for mloeri.com, the credentialed request path includes them with the event.

Captured request

GEThttps://mloeri.com/track/evt.php?extid=edcdolejdklgjkjinjknidifilkpnmgn&feature=forecast&value=open

No request body is sent. No live response body was recorded because the automated analysis did not open the extension feature UI.

The code that does this

Shipped code that builds the mloeri.com event requests

Readable version

Show shipped source

Credentialed page-script request

deobfuscated/func.js

function trackFeature(feature, value) {    var url = 'https://mloeri.com/track/evt.php?extid='+chrome.runtime.id+'&feature='+encodeURIComponent(feature)+'&value='+encodeURIComponent(value);    var xhr = new XMLHttpRequest();    xhr.withCredentials = true;    xhr.open('GET', url, true);    xhr.send('');}

Background request with stored install values

deobfuscated/bg.js

function trackFeature (feature, value) {    chrome.storage.sync.get(['cohort', 'install_time'], function(data) {        var url = 'https://mloeri.com/track/evt.php?extid='+chrome.runtime.id+'&feature='+encodeURIComponent(feature)+'&value='+encodeURIComponent(value);        if (data['install_time']) {            url += '&install_time='+data['install_time']        }        if (data['cohort']) {            url += '&cohort='+encodeURIComponent(data['cohort']);        }        fetch(url);    });}chrome.runtime.onMessage.addListener(    function(request, sender, sendResponse) {        if (request.feature) {            trackFeature(request.feature, request.value);        }    });

The code that does this

Examples of feature interactions that call trackFeature

Readable version

Show shipped source

UI interaction call sites

deobfuscated/func.js

$(document).on('click', function (e) {    if ($(e.target).closest('#weather').length) {        if ($("#forecast").is(':hidden')) {            trackFeature('forecast', 'open');        }        $("#forecast").slideToggle();    } else if (!$(e.target).closest('#forecast').length) {        $('#forecast').slideUp();    }});$(document).on('click', function (e) {    if ($(e.target).closest('#menu').length) {        if ($("#menuTools").is(':hidden')) {            trackFeature('quick_links', 'open');        }        $("#menuTools").slideToggle();    } else if (!$(e.target).closest('#menuTools').length) {        $('#menuTools').slideUp();    }});$(document).on('click', function (e) {    if ($(e.target).closest('#topSitesIcon').length) {        if ($("#topSitesMenu").is(':hidden')) {            trackFeature('top_sites', 'open');        }        $("#topSitesMenu").slideToggle();    } else if (!$(e.target).closest('#topSitesMenu').length) {        $('#topSitesMenu').slideUp();    }});

Destination receiving feature telemetry

- mloeri.com
Receives feature interaction events at /track/evt.php, including feature/value parameters and stored install values when present.

Searches route through webresult.info before the engine

Submitting a search in Mystique redirects to webresult.info/search.php before the chosen provider.

The redirect carries the typed term, extension ID, and stored install time/cohort.

No live request recorded; testing never typed in the box.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

You submit a search from Mystique's search box.

The handler runs when you press Enter in the search field or click the search button.

The extension did this

Mystique redirects your browser through webresult.info with the search query in the URL.

The same function also sends a search feature event to the extension background script.

Fields prepared for the webresult.info search redirect

Search query
weather tomorrow (illustrative)
The words you type into Mystique's search box are sent in the redirect URL.
Extension ID
edcdolejdklgjkjinjknidifilkpnmgn
Identifies the Chrome extension that generated the search redirect.
Search provider marker
p=yhs&u=mystique
Indicates the provider path selected by the extension for the redirect.
Install time
1713139200 (illustrative)
Can connect multiple searches back to the same extension install over time.
Cohort
default (illustrative)
Can group your searches with a stored rollout or experiment value.

Captured request

GEThttps://webresult.info/search.php?p=yhs&extid=edcdolejdklgjkjinjknidifilkpnmgn&u=mystique&q=weather%20tomorrow

No request body is sent. No live response body was recorded because the automated analysis did not submit the extension search form.

The code that does this

Shipped code that redirects searches through webresult.info

Readable version

Show shipped source

Search box event handlers and redirect function

deobfuscated/func.js

// Searching$('#searchTextbox').focus();$('#searchTextbox').keypress(function (e) {    if (e.keyCode == 13) {        runSearch();    }});$('#searchClose').click(function () {    $('.searchEngine').hide();    $('#searchResults').hide();});$('#searchButton').click(function () {    runSearch();});function runSearch() {    var searchTerm = document.getElementById('searchTextbox').value;    chrome.runtime.sendMessage({feature: "search", value: searchTerm});    chrome.storage.sync.get(['cohort', 'install_time'], function(data) {        var url = 'https://webresult.info/search.php?p=yhs&extid='+chrome.runtime.id+'&u=mystique&q=' + encodeURIComponent(searchTerm);        if (data['install_time']) {            url += '&install_time='+data['install_time']        }        if (data['cohort']) {            url += '&cohort='+encodeURIComponent(data['cohort']);        }        window.location = url;    });}

Destination receiving search redirects

- webresult.info
Receives search redirects at /search.php with the typed query, extension ID, provider marker, and stored install values when present.

What it can do

Permissions this extension asks for, as declared in version 1.0.26. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

Read your physical location
geolocation
Store data in your browser
storage
Read the sites you visit most
topSites