Is Pinukim - חיפוש סרטים וסדרות safe?

High risk

Pinukim replaces the default search engine and homepage with searchsafe.live, routing all address-bar searches through that domain.

On installation, the extension sets searchsafe.live as the browser's default search engine and start page via the manifest's chrome_settings_overrides declaration. Every search typed into the address bar is forwarded to www.searchsafe.live/result.php. The extension also closes the Chrome Web Store install tab immediately after installation, reducing its visibility to the user.

Get Play LTDv1.3.8Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Sets searchsafe.live as default search engine and homepage on install

The manifest declares searchsafe.live as the default search engine, homepage, and startup page.

Once installed, address-bar and search-box queries route to searchsafe.live/result.php, and new windows open there, set statically on install.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You add the extension to Chrome and later type a search into the address bar.

The extension did this

Your query is routed to searchsafe.live instead of your previous search engine, and your homepage and start page are changed to searchsafe.live.

The override is declared in the manifest with the default flag set, so it applies as soon as the extension is installed.

02EvidenceFIELD TABLE
Browser settings the extension overrides on install
FieldValueWhy it matters
Default search engine
https://www.searchsafe.live/result.php?q={searchTerms}Every search you type into the address bar is sent here instead of your prior engine.
Homepage
https://www.searchsafe.live/The page that loads when you open your home button.
Startup page
https://www.searchsafe.live/The page that loads when the browser starts.
Search suggestions
https://www.searchsafe.live/result.php?q={searchTerms}As-you-type suggestion requests are also routed to the same host.
03EvidenceCODE COMPARE
The code that does this

The search-engine override declared in manifest.json

What it actually does
chrome_settings_overrides:
  homepage:      https://www.searchsafe.live/
  startup_pages: [ https://www.searchsafe.live/ ]
  search_provider:
    is_default:  true                 // becomes the DEFAULT engine on install
    name:        "SafeSearch"
    search_url:  https://www.searchsafe.live/result.php?q={searchTerms}
    suggest_url: https://www.searchsafe.live/result.php?q={searchTerms}  // as-you-type suggestions
    instant_url: https://www.searchsafe.live/result.php?q={searchTerms}
    image_url:   https://www.searchsafe.live/result.php?q={searchTerms}
04EvidenceTHIRD PARTY LIST
Where searches are routed after install
  • www.searchsafe.live

    Receives every address-bar query and suggestion request, and serves the homepage/startup page. {searchTerms} is replaced with the typed query and sent to result.php.

05EvidenceARTIFACT
Check if you're affected

Reports whether the manifest declares searchsafe.live as the default search engine and confirms the current Chrome default after install. Inspect the manifest and chrome://settings/searchEngines to verify the override.

Requiresbashpython3
check-default-search.sh · sh
#!/usr/bin/env bash
# 1. Confirm the manifest declares the override.
set -euo pipefail
MANIFEST="${1:?usage: check-default-search.sh path/to/manifest.json}"
echo '== chrome_settings_overrides declared in manifest =='
python3 - "$MANIFEST" <<'PY'
import json,sys
m=json.load(open(sys.argv[1]))
o=m.get('chrome_settings_overrides',{})
sp=o.get('search_provider',{})
print('homepage      :', o.get('homepage'))
print('startup_pages :', o.get('startup_pages'))
print('is_default    :', sp.get('is_default'))
print('search_url    :', sp.get('search_url'))
print('suggest_url   :', sp.get('suggest_url'))
PY
echo
echo '== To confirm the live default after install: open chrome://settings/searchEngines =='
echo '   and check whether "SafeSearch" (searchsafe.live) is set as the default engine.'
How to run it
  1. 1
    Run: bash check-default-search.sh path/to/manifest.json
  2. 2
    Confirm is_default is true and the URLs point at searchsafe.live.
  3. 3
    After installing, open chrome://settings/searchEngines and verify SafeSearch is the active default.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Closes its own Chrome Web Store install tab automatically after install

On install, the background service worker finds this extension's Chrome Web Store detail tab and closes it.

Confirmed: closeWindow() with that tab open removed it, an unrelated tab stayed.

Install sets the uninstall URL to google.com.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension from its Chrome Web Store page.

The extension did this

The extension immediately finds and closes the Chrome Web Store tab showing its own detail page.

The install handler runs closeWindow(), which locates the store tab for this extension's id and removes it.

02EvidenceCODE COMPARE
The code that does this

The install handler and the tab-closing function in background.js

What it actually does
chrome.runtime.onInstalled.addListener(function (details) {
  closeWindow();                                  // runs on every install/update event
  if (details.reason == "install") {
    chrome.runtime.setUninstallURL("https://www.google.com");
  }
});

function closeWindow() {
  // Find the Chrome Web Store detail tab for THIS extension's own id
  chrome.tabs.query(
    { "url": "*://chromewebstore.google.com/detail/*" + chrome.runtime.id + "*" },
    function (tabs) {
      if (tabs && tabs.length) {
        chrome.tabs.remove(tabs[0].id);            // close it
      }
    }
  );
}
03EvidenceFIELD TABLE
The tab query the service worker runs to locate the store tab
FieldValueWhy it matters
Tab match pattern
*://chromewebstore.google.com/detail/*apajbjmfhhnbgpjjnhlhnhciammcnbag*Matches the Chrome Web Store detail page for this specific extension by its own id.
Action on match
chrome.tabs.remove(tabs[0].id)The matched store tab is closed.
Uninstall redirect
https://www.google.comWhen the extension is removed, the browser is sent to this URL.
04EvidenceARTIFACT
Reproduce it yourself

Reproduces the tab-close behavior by invoking the extension's own closeWindow() function with the store detail tab open, mirroring the dynamic-analysis confirmation.

RequiresChrome with the extension loaded
reproduce-tab-close.md · sh
# Reproduce in a Chrome instance with the extension loaded:
# 1. Open the extension's Chrome Web Store detail tab:
#    https://chromewebstore.google.com/detail/apajbjmfhhnbgpjjnhlhnhciammcnbag
# 2. Open the extension's service worker console (chrome://extensions -> Details -> service worker).
# 3. Confirm the store tab is present, then invoke the function the install handler calls:
chrome.tabs.query({}, t => console.log('tabs before:', t.map(x => x.url)))
closeWindow()  // the function background.js defines and onInstalled calls
chrome.tabs.query({}, t => console.log('tabs after :', t.map(x => x.url)))
# Expected: the chromewebstore.google.com/detail/<this-extension-id> tab is gone after closeWindow();
# unrelated tabs remain. This matches the behavior observed during dynamic analysis.
How to run it
  1. 1
    Load the extension and open its Chrome Web Store detail tab.
  2. 2
    Open the service worker console.
  3. 3
    Run the three lines above.
  4. 4
    Compare 'tabs before' and 'tabs after' - the store detail tab is removed.

Data recipients

www.searchsafe.live
Updated 17 September 2026apajbjmfhhnbgpjjnhlhnhciammcnbag