Is ProtectedSearch.io safe?
ProtectedSearch.io redirects Google and Bing search navigations to protectedsearchesio.com with the original query.
When you open matching Google or Bing search pages, the extension rewrites the page load to ProtectedSearch.io's search endpoint and keeps the search term in the request. This sends the original query from those searches to www.protectedsearchesio.com.
Who publishes itHermione Carrillo - no other listings under this identity
Hermione Carrillo - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension redirects your Google and Bing searches to a partner site
When you search on Google or Bing, the extension intercepts the results page load and redirects your browser to protectedsearchesio.com before Google or Bing responds, carrying your exact search text in the new URL.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You type a search into Google or Bing and view the results page.
e.g. https://www.google.com/search?q=... or https://www.bing.com/search?q=...&FORM=...
The extension's declarativeNetRequest rule intercepts that page load and redirects your browser to protectedsearchesio.com, carrying your exact search text along.
We observed a redirect firing before Google's or Bing's own results ever loaded.
- Your search termsq=cws-canary
The exact text you typed into Google or Bing is copied into the redirect URL's q parameter.
- Which search engine you usedosp=google
A flag showing whether you searched on Google or Bing, letting the redirect be attributed to the source engine.
- Partner/affiliate codes=y5pr&vert=private&category=web
A fixed identifier included on every redirect, used to attribute your traffic to whoever distributes this extension.
307 Temporary Redirect, delivered instead of Google's own results for https://www.google.com/search?q=cws-canary&sourceid=chrome. The same pattern was independently confirmed on Bing (https://www.bing.com/search?q=cws-canary&FORM=QBLH), which redirects to the same destination with osp=bing.
The declarativeNetRequest rule that rewrites your search into a redirect
What the regex groups actually do
// Matches any Google results page whose URL also contains "&sourceid="// (present on essentially every real user search, not just deep links).regexFilter: "(^.*?google.com/search?q=)" + // group 1: everything up to and including "q=" "([^&]*)" + // group 2: YOUR SEARCH TEXT, up to the next "&" "(.*)(.*)&sourceid=([^&]*)(.*)" // groups 3-6: the rest of the URL, unused// The matched URL is thrown away. Only group 2 (your search text) survives,// pasted straight into a new URL pointed at protectedsearchesio.com:regexSubstitution: "https://www.protectedsearchesio.com/search/?category=web" + "&s=y5pr&vert=private&osp=google" + "&q=" + group2 // <-- your literal search query- www.protectedsearchesio.com
Receives your literal Google or Bing search text via the redirect and serves its own results; also set by this extension as the browser's default search provider.
What it can do
Permissions this extension asks for, as declared in version 3.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed ProtectedSearch.io contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.protectedsearchesio.com
ProtectedSearch.io sends data to www.protectedsearchesio.com. No other extension we have analysed sends data here.