Is Recipe Search safe?
Recipe Search tags default-search queries with a persistent extension GUID and campaign type before redirecting them.
Recipe Search makes Freshy Search the browser's default search provider and installs redirect rules after setup. When a user searches from the address bar, the redirected search URL includes the search terms plus a stored GUID and campaign type.
Who publishes itTightrope Interactive - 13 other listings from the same operator, 3 of them carrying a finding
Tightrope Interactive - 13 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 13 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Search redirects attach an extension GUID to user search queries
When you search through Recipe Search, the extension routes the query through Freshy search endpoints.
The redirect adds the search terms, a stored extension GUID, and campaign type data, linking searches to extension identifiers.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user performs a search through the extension's default search, popup, or omnibox flow.
The extension rewrites the search request so the query is sent with a stored GUID and campaign type value.
- Your search termschicken soup recipe (illustrative)
Text entered into the search box is included in the redirected search URL.
- Search request URLhttps://search.freshysearch-api.net/crx/search.php?k=chicken%20soup&type=recipe&action=ds&guid=d7f3a1b2-... (illustrative)
The navigation is rewritten to a Freshy search endpoint that carries the query and tracking parameters.
- Stored extension GUIDd7f3a1b2-4c5d-6789-... (illustrative)
A persistent identifier from extension storage is attached to redirected search requests.
Dynamic analysis confirmed that the extension sets Freshy Search as the default search provider, reads the stored GUID and type values, and redirects search flows through Freshy URLs carrying those values.
What it can do
Permissions this extension asks for, as declared in version 1.23.802. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on freshysearch-api.net
*://*.freshysearch-api.net/*
Read and change your data on cooking.freshy.com
*://*.cooking.freshy.com/core/v2/complete/*
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Run searches with your default search engine
search
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed Recipe Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- search.freshysearch-api.net
Recipe Search sends data to search.freshysearch-api.net. One other extension we have analysed sends data here.
- search.freshy.com
Recipe Search sends data to search.freshy.com. No other extension we have analysed sends data here.