Is Omni Convert - Search Settings for Omnibar safe?

Medium risk

Omni Convert redirects default omnibox search queries to find.madmidas.net monetized results.

When you search from the address bar, the extension sets Chrome's default search provider to an app.clipconverter.site URL. Its background rule rewrites that search navigation to find.madmidas.net/results.aspx, preserving the original query and adding monetization parameters.

clipconvertersitev1.013Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Default Search Redirects Every Query to a Monetized Results Page

Left as Chrome's default search, the extension redirects omnibox searches away from its endpoint.

A declarativeNetRequest rule intercepts app.clipconverter.site, redirecting to find.madmidas.net with your search term, unnamed in the Store.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You leave this extension's search engine as Chrome's default and type a search into the address bar.

No extra configuration is required; this is the extension's install-time default.

The extension did this

The extension redirects your exact search term to find.madmidas.net, a monetized results page that is never named in its Chrome Web Store listing.

A declarativeNetRequest rule registered by the background service worker rewrites the request to the manifest-declared search endpoint before it loads.

What the redirected request carries
  • Your exact search term
    best wireless headphones 2026

    Every word you type into the address bar with this engine as default is forwarded verbatim to a third-party results page.

  • Affiliate/campaign ID
    gd=SY1003141

    A fixed identifier sent with every redirected query, letting the destination attribute traffic back to this extension.

  • Search source code
    searchsource=58

    A fixed code identifying the traffic as coming from this extension's search integration.

Captured request
GEThttps://find.madmidas.net/results.aspx?gd=SY1003141&searchsource=58&q=best%20wireless%20headphones%202026

307 redirect issued by the extension's declarativeNetRequest rule from the manifest-declared endpoint https://app.clipconverter.site/ext/search.php/?a=b&q=<term>, landing the browser on this find.madmidas.net results page with the query preserved.

The code that does this

Manifest search provider vs. the rule that overrides it

Readable version
// Runs immediately when the service worker starts (lib/bg.js, top-level).const monetizedResultsPage = 'https://find.madmidas.net/results.aspx?gd=SY1003141&searchsource=58&q=';chrome.declarativeNetRequest.updateDynamicRules({  addRules: [{    id: 1,    priority: 1,    action: {      type: 'redirect',      redirect: {        // (.*) captured from the matched URL below is appended here,        // so the original search term survives the redirect intact.        regexSubstitution: monetizedResultsPage + '\\1'      }    },    condition: {      // Matches every request Chrome sends to the search endpoint      // declared as default in manifest.json.      regexFilter: '^https://app\\.clipconverter\\.site/ext/search\\.php/\\?a=b&q=(.*)',      resourceTypes: ['main_frame']    }  }],  removeRuleIds: [1]});// Net effect: app.clipconverter.site — the endpoint named in the manifest// as the default search provider — never actually receives the search.// find.madmidas.net does, with the original query term preserved verbatim.
Where searches actually go
    • find.madmidas.net

    Receives the full search term on every default-search navigation via the extension's redirect rule. Not named in the Chrome Web Store listing or manifest-declared search provider.

    • app.clipconverter.site

    The search endpoint actually declared in the manifest as the default provider. Every query is sent here first, then immediately redirected before this host's response is ever used.

    • lp.clipconverter.site

    Same operator as app.clipconverter.site; serves the install-success and privacy/terms pages, and hosts the alternate affiliate-tagged search redirects offered in the popup.

What it can do

Permissions this extension asks for, as declared in version 1.013. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on app.clipconverter.site

    *://app.clipconverter.site/*

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

Where it sends data

Destinations our analysis observed Omni Convert - Search Settings for Omnibar contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • find.madmidas.net

    Omni Convert - Search Settings for Omnibar sends data to find.madmidas.net. No other extension we have analysed sends data here.

Updated 30 September 2026fgnfdemimflmkkmdilkloicmdigmjghp