Is Pomodoro safe?

Medium risk

Pomodoro overrides the browser's default search engine to pomodorosearch.com, routing all omnibox queries through a third-party domain with a per-install tracking ID.

When installed, the extension sets pomodorosearch.com as the default search engine using a declarative manifest entry. Every search typed into the address bar is forwarded to pomodorosearch.com with a static tracking parameter (id=ID) embedded in the URL template. The extension contains no other JavaScript code — its sole function is this search provider override.

pomodorosearchv1.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search queries routed to pomodorosearch.com on install

Installing this extension replaces the browser's default search engine with pomodorosearch.com.

Every address-bar query is forwarded to that domain, including queries expected to stay within the configured engine, per the manifest.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You install the Pomodoro extension.

No further interaction is needed, the search engine override activates at install time.

The extension did this

The extension sets pomodorosearch.com as your default search engine via a manifest declaration.

Every omnibox query is now forwarded to pomodorosearch.com/search with the search terms and a version parameter.

Parameters included in every search request
  • Search terms
    best password manager

    The words you typed into the address bar are forwarded to pomodorosearch.com.

  • Extension version
    v=1.0

    The v= parameter identifies which extension version is routing the query.

  • Identifier parameter
    id=ID

    The id= parameter is sent with every query. In this manifest the value is a literal string 'ID' rather than a per-install token.

The code that does this

Manifest chrome_settings_overrides block

Readable version
// is_default: true  →  Chrome installs this as the default search engine on extension load// search_url template →  {searchTerms} is replaced by Chrome with whatever the user typed// id=ID             →  literal string sent with every request (not a per-install token in this build)// Result: GET https://pomodorosearch.com/search?v=1.0&id=ID&q=<user_query>
Destination receiving all search queries
    • pomodorosearch.com

    Receives every omnibox search query routed by the extension. Unaffiliated with the Pomodoro productivity technique brand.

Where it sends data

Destinations our analysis observed Pomodoro contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • pomodorosearch.com

    Pomodoro sends data to pomodorosearch.com. No other extension we have analysed sends data here.

Updated 30 September 2026mlfelkmlpmhleeclefagnddgocdngibo