Is Recipe Finder with Ingredients: Cook With What You Have safe?

Medium risk

Recipe Finder replaces the default search engine with chromecrxstore.com, labelled 'Internet'.

The extension's manifest sets a default search provider that sends every address-bar search and each typed suggestion request to chromecrxstore.com. The recipe feature itself (omnibox keyword 'cook' and a context menu) only opens recipe pages on the same site. The generic provider name 'Internet' does not indicate the change.

AdBhuT Extensionsv1.4Chrome Web Store
49Risk
Who publishes it

AdBhuT Extensions - 5 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AdBhuT Extensions

Same store account

5 other listings published from this account, 199 users between them. 3 of them carry a finding.

USA Deal Finder81MediumPrice Comparison – Amazon vs. Walmart, Target, Best Buy, eBay & more61CleanAcademic Search Navigator35MediumRight Click to Search Any Site: Youtube, Reddit, Wikipedia, Twitter & More14MediumRealSearch - Human Answers Only (No AI Spam)8Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Recipe Finder extension sets chromecrxstore.com as the default search engine

The manifest sets a search provider named 'Internet' as default, routing address-bar queries and suggestions to chromecrxstore.com.

The listing describes a recipe finder only.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You type a query in the address bar and press Enter.

The extension did this

The query is sent to chromecrxstore.com instead of your previous search engine.

Suggestion requests are sent as you type.

Search provider fields in the manifest
  • Name
    Internet

    Generic label shown in browser settings.

  • Search URL
    https://chromecrxstore.com/query/index.html?q={searchTerms}

    Where each address-bar query is sent.

  • Suggest URL
    https://chromecrxstore.com/suggest.php?q={searchTerms}

    Receives the text as you type.

  • Default
    is_default: true

    Makes this provider the default.

The code that does this

manifest.json search provider override

Readable version

background.js: the recipe feature is separate and only opens a tab

background.js
const SEARCH_PAGE_URL = "https://chromecrxstore.com/recipesearch/";chrome.omnibox.onInputEntered.addListener((text) => {    performSearch(text);});function performSearch(queryText) {    const finalQuery = `${queryText.trim()} recipe`;    chrome.tabs.create({ url: `${SEARCH_PAGE_URL}?q=${encodeURIComponent(finalQuery)}` });}
Hosts receiving address-bar queries
    • chromecrxstore.com

    Receives search and suggest requests; also hosts the recipe search page.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Recipe Finder with Ingredients: Cook With What You Have contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromecrxstore.com

    Recipe Finder with Ingredients: Cook With What You Have sends data to chromecrxstore.com. 13 other extensions we have analysed send data here.

Updated 15 October 2026kpkookmoimnebanjalogloohpapajpee