Is Pinukim - חיפוש סרטים וסדרות safe?
Pinukim replaces the default search engine and homepage with searchsafe.live, routing all address-bar searches through that domain.
On installation, the extension sets searchsafe.live as the browser's default search engine and start page via the manifest's chrome_settings_overrides declaration. Every search typed into the address bar is forwarded to www.searchsafe.live/result.php. The extension also closes the Chrome Web Store install tab immediately after installation, reducing its visibility to the user.
Who publishes itGet Play LTD - 2 other listings from the same operator, none carrying a finding
Get Play LTD - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 39k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Sets searchsafe.live as default search engine and homepage on install
The manifest declares searchsafe.live as the default search engine, homepage, and startup page.
Once installed, address-bar and search-box queries route to searchsafe.live/result.php, and new windows open there, set statically on install.
What actually happens
You add the extension to Chrome and later type a search into the address bar.
Your query is routed to searchsafe.live instead of your previous search engine, and your homepage and start page are changed to searchsafe.live.
The override is declared in the manifest with the default flag set, so it applies as soon as the extension is installed.
Browser settings the extension overrides on install
- Default search enginehttps://www.searchsafe.live/result.php?q={searchTerms}
Every search you type into the address bar is sent here instead of your prior engine.
- Homepagehttps://www.searchsafe.live/
The page that loads when you open your home button.
- Startup pagehttps://www.searchsafe.live/
The page that loads when the browser starts.
- Search suggestionshttps://www.searchsafe.live/result.php?q={searchTerms}
As-you-type suggestion requests are also routed to the same host.
The code that does this
The search-engine override declared in manifest.json
chrome_settings_overrides: homepage: https://www.searchsafe.live/ startup_pages: [ https://www.searchsafe.live/ ] search_provider: is_default: true // becomes the DEFAULT engine on install name: "SafeSearch" search_url: https://www.searchsafe.live/result.php?q={searchTerms} suggest_url: https://www.searchsafe.live/result.php?q={searchTerms} // as-you-type suggestions instant_url: https://www.searchsafe.live/result.php?q={searchTerms} image_url: https://www.searchsafe.live/result.php?q={searchTerms}Where searches are routed after install
- www.searchsafe.live
Receives every address-bar query and suggestion request, and serves the homepage/startup page. {searchTerms} is replaced with the typed query and sent to result.php.
Check if you're affected
Reports whether the manifest declares searchsafe.live as the default search engine and confirms the current Chrome default after install. Inspect the manifest and chrome://settings/searchEngines to verify the override.
- bash
- python3
#!/usr/bin/env bash# 1. Confirm the manifest declares the override.set -euo pipefailMANIFEST="${1:?usage: check-default-search.sh path/to/manifest.json}"echo '== chrome_settings_overrides declared in manifest =='python3 - "$MANIFEST" <<'PY'import json,sysm=json.load(open(sys.argv[1]))o=m.get('chrome_settings_overrides',{})sp=o.get('search_provider',{})print('homepage :', o.get('homepage'))print('startup_pages :', o.get('startup_pages'))print('is_default :', sp.get('is_default'))print('search_url :', sp.get('search_url'))print('suggest_url :', sp.get('suggest_url'))PYechoecho '== To confirm the live default after install: open chrome://settings/searchEngines =='echo ' and check whether "SafeSearch" (searchsafe.live) is set as the default engine.'- 1Run: bash check-default-search.sh path/to/manifest.json
- 2Confirm is_default is true and the URLs point at searchsafe.live.
- 3After installing, open chrome://settings/searchEngines and verify SafeSearch is the active default.
Closes its own Chrome Web Store install tab automatically after install
On install, the background service worker finds this extension's Chrome Web Store detail tab and closes it.
Confirmed: closeWindow() with that tab open removed it, an unrelated tab stayed.
Install sets the uninstall URL to google.com.
What actually happens
You install the extension from its Chrome Web Store page.
The extension immediately finds and closes the Chrome Web Store tab showing its own detail page.
The install handler runs closeWindow(), which locates the store tab for this extension's id and removes it.
The code that does this
The install handler and the tab-closing function in background.js
chrome.runtime.onInstalled.addListener(function (details) { closeWindow(); // runs on every install/update event if (details.reason == "install") { chrome.runtime.setUninstallURL("https://www.google.com"); }});function closeWindow() { // Find the Chrome Web Store detail tab for THIS extension's own id chrome.tabs.query( { "url": "*://chromewebstore.google.com/detail/*" + chrome.runtime.id + "*" }, function (tabs) { if (tabs && tabs.length) { chrome.tabs.remove(tabs[0].id); // close it } } );}The tab query the service worker runs to locate the store tab
- Tab match pattern*://chromewebstore.google.com/detail/*apajbjmfhhnbgpjjnhlhnhciammcnbag*
Matches the Chrome Web Store detail page for this specific extension by its own id.
- Action on matchchrome.tabs.remove(tabs[0].id)
The matched store tab is closed.
- Uninstall redirecthttps://www.google.com
When the extension is removed, the browser is sent to this URL.
Reproduce it yourself
Reproduces the tab-close behavior by invoking the extension's own closeWindow() function with the store detail tab open, mirroring the dynamic-analysis confirmation.
- Chrome with the extension loaded
# Reproduce in a Chrome instance with the extension loaded:# 1. Open the extension's Chrome Web Store detail tab:# https://chromewebstore.google.com/detail/apajbjmfhhnbgpjjnhlhnhciammcnbag# 2. Open the extension's service worker console (chrome://extensions -> Details -> service worker).# 3. Confirm the store tab is present, then invoke the function the install handler calls:chrome.tabs.query({}, t => console.log('tabs before:', t.map(x => x.url)))closeWindow() // the function background.js defines and onInstalled callschrome.tabs.query({}, t => console.log('tabs after :', t.map(x => x.url)))# Expected: the chromewebstore.google.com/detail/<this-extension-id> tab is gone after closeWindow();# unrelated tabs remain. This matches the behavior observed during dynamic analysis.- 1Load the extension and open its Chrome Web Store detail tab.
- 2Open the service worker console.
- 3Run the three lines above.
- 4Compare 'tabs before' and 'tabs after' - the store detail tab is removed.
What it can do
Permissions this extension asks for, as declared in version 1.3.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed Pinukim - חיפוש סרטים וסדרות contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.searchsafe.live
Pinukim - חיפוש סרטים וסדרות sends data to www.searchsafe.live. No other extension we have analyzed sends data here.