Is Quick Recipe Hub & Custom Web Search safe?

Medium risk

Quick Recipe Hub & Custom Web Search sets Yahoo as the default search engine with affiliate tracking parameters appended to every query.

The extension replaces the browser's default search provider with a Yahoo search URL that includes hardcoded affiliate identifiers (hspart=sz, hsimp=yhs-001, param1, param2, type). Its popup search box also routes queries through a separately configured affiliate-tagged Yahoo URL. The extension's description discloses Yahoo search integration but does not disclose the affiliate monetization embedded in the search URLs.

Quick Recipe Hubv1.0.0.2Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab searches route through a tagged Yahoo URL

MediumunwantedCWE-506Dynamic sandbox

When you use the new-tab search box, the extension builds a Yahoo YHS search URL from its own JavaScript instead of a plain Yahoo search URL, adding hardcoded parameters param1, param2, type, hspart, and hsimp before your search terms.

What actually happens

You did this

You submit a search from the extension's new-tab page.

Pressing Enter in the search box or clicking the search button calls the same search handler.

The extension did this

The extension navigates the tab to Yahoo with fixed URL parameters already attached.

Your query is appended to the value stored in specificConstants.searchComp.

Fields added to the Yahoo search URL

  • Search endpoint
    https://search.yahoo.com/yhs/search

    This is where your search is sent after you use the new-tab search box.

  • Partner code
    hspart=sz

    This tags the request as coming through a specific search partner path.

  • Implementation code
    hsimp=yhs-001

    This adds another fixed Yahoo YHS implementation tag to the same search request.

  • Campaign identifiers
    param1=83720&param2=89705&type=type7020893-spa-83720-89705

    These fixed values identify the search-routing configuration bundled with the extension.

  • Your search terms
    p=chicken%20recipes

    Whatever you type into the new-tab search box is placed in the Yahoo search URL.

Captured request

GEThttps://search.yahoo.com/yhs/search?param1=83720&param2=89705&type=type7020893-spa-83720-89705&hspart=sz&hsimp=yhs-001&p=chicken%20recipes

Browser navigation to Yahoo search results; no request body is used for this GET navigation.

The code that does this

The new-tab page replaces the plain Yahoo URL with the tagged Yahoo YHS URL

Readable version

Hardcoded search destination

html/js/constants.js
var specificConstants = {    "API": "https:\/\/quickrecipehub.com\/apps\/",    "domain": "quickrecipehub.com",    "searchComp": "https://search.yahoo.com/yhs/search?param1=83720&param2=89705&type=type7020893-spa-83720-89705&hspart=sz&hsimp=yhs-001&p=",};

Search URL selection

html/js/homepage.js
function search(searchBox) {    var searchTerm = searchBox.val().trim();    if (!searchTerm) return;    var search = Constants.DEFAULT_SEARCH_URL + searchTerm;    if (typeof specificConstants !== 'undefined' && !!specificConstants[OtherDimensions.searchComp]) {        search = specificConstants[OtherDimensions.searchComp] + searchTerm;    }    window.location.href = search;}

Enter key and button bindings

html/js/homepage.js
(function () {    HtmlUtil.documentOnLoad(function () {        const searchBox = $(SEARCH_TEXT_CLASS);        const searchForm = $(SEARCH_FORM_CLASS);        const searchBtn = $(SEARCH_BTN_CLASS);        searchBox.each(function (index) {            var searchBoxElement = $(searchBox[index]);            searchBoxElement.on('keypress', function (event) {                if (event.which === 13) {                    event.preventDefault();                    search(searchBoxElement);                }            });            searchBoxElement.focus();        });        searchForm.each(function (index) {            var searchFormElement = $(searchForm[index]);            var searchBtnElement = searchFormElement.find(SEARCH_BTN_CLASS);            var searchBoxElement = searchFormElement.find(SEARCH_TEXT_CLASS);            searchBtnElement.on('click', function (e) {                e.preventDefault();                search(searchBoxElement);            });        });    });})();

External destination used by the new-tab search

    • search.yahoo.com

    Receives the Yahoo YHS search request containing the user's query and the fixed hspart, hsimp, type, param1, and param2 values.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on quickrecipehub.com

    *://quickrecipehub.com/

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Quick Recipe Hub & Custom Web Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • search.yahoo.comwidely used

    Quick Recipe Hub & Custom Web Search sends data to search.yahoo.com. A widely used service: 39 other extensions we have analyzed send data here.

Updated 2 November 2026amo-2752313