Is Random number generator safe?

Medium risk

Random number generator redirects matching site visits through a bit.ly URL that appends the current page URL.

The extension fetches redirect rules from calculat.pro/clsr and shares them with a content script that runs on all websites. When the current URL matches those rules and the hostname is configured, such as random.org, calculator.net, or mathgoodies.com, the page is redirected to a bit.ly link with the full current URL appended.

grunbasterv0.1.3Chrome Web Store
45Risk
Who publishes it

grunbaster - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
grunbaster

Same store account

1 other listing published from this account, 30k+ users between them, none of them carrying a finding.

Dark theme for Wikipedia site or Night mode for Wikipedia site30k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Random Number Generator reroutes visits to 3 reference sites through bit.ly

On random.org, calculator.net, or mathgoodies.com, the extension's content script navigates your tab to a bit.ly link with the full page URL appended, using redirect rules it fetches from calculat.pro on every startup.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open www.random.org, www.calculator.net, or www.mathgoodies.com in a tab.

The extension's content script runs on every page you visit.

The extension did this

The tab is navigated to a bit.ly link with your full page URL appended.

This redirect is not mentioned in the extension's Chrome Web Store listing, which describes it only as a random number generator.

Captured request
GEThttps://calculat.pro/clsr

JSON body containing defaultMatches, a regex string matching random.org, calculator.net, and mathgoodies.com, and defaultLinks, an array mapping each domain to the redirect prefix https://bit.ly/35iaO4D?.

Headers
Accept
application/json
Captured request
GEThttps://bit.ly/35iaO4D?https://www.random.org/

301 redirect issued by bit.ly. Observed during dynamic analysis immediately after navigating to www.random.org, and again for www.calculator.net with that site's URL appended instead.

The code that does this

The redirect check content.js runs on every page load

Readable version

Renamed equivalent of the snippet above

var canRedirectAgain = cooldownElapsed('ckAli'); // true unless this origin redirected in the last 3 dayschrome.runtime.sendMessage({ start: true }, backgroundConfig => {    if (backgroundConfig && backgroundConfig.defaultMatches) {        let siteMatchRegex = new RegExp(backgroundConfig.defaultMatches, "i");        let redirectTable = backgroundConfig.defaultLinks; // [[domainFragment, bitlyPrefix], ...]        if (window.location.href.match(siteMatchRegex) && canRedirectAgain) {            let currentUrl = new URL(window.location.href);            let hostname = currentUrl.hostname;            for (let i in redirectTable) {                if (hostname.indexOf(redirectTable[i][0]) != -1) {                    let nowSeconds = Math.floor(Date.now() / 1e3);                    localStorage.setItem('ckAli', nowSeconds); // start the 3-day cooldown for this origin                    window.location.href = redirectTable[i][1] + window.location.href; // navigate through bit.ly with the full URL appended                    break;                }            }        }    }});function cooldownElapsed(storageKey) {    let nowSeconds = Math.floor(Date.now() / 1e3),        lastFired = parseInt(localStorage.getItem(storageKey)) || 0;    return !(nowSeconds - lastFired < 259200); // 259200s = 3 days}
Where the redirect rules and the redirect itself go
    • calculat.pro

    Remote config fetched on every startup. Controls which sites trigger a redirect and where the redirect goes, changeable at any time without a new extension version.

    • bit.ly

    Link-shortener the tab is navigated to on a match, with the full visited page URL appended as the destination.

What it can do

Permissions this extension asks for, as declared in version 0.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Random contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • bit.ly

    Random sends data to bit.ly. 2 other extensions we have analysed send data here.

Updated 30 September 2026ninanjeenomfmcihkpoaelaoddaboica