Is Recruit CRM Sourcing Extension safe?

High risk

Recruit CRM Sourcing Extension is high risk. Every time its background service worker starts, the extension checks whether third-party cookies are disabled and, if it can, turns them back on for your whole browser, not just for Recruit CRM's own sites.…

recruit-crmv3.2.24Chrome Web Store
69Risk
Who publishes it

Workforce Cloud Tech, Inc. - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
recruit-crm
Declared legal entity
Workforce Cloud Tech, Inc.
Registered address
28 Mohawk Ave, Norwood, NJ 07648-2411, US
Registered contact
Workforce Cloud Tech, Inc.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

albatross.recruitcrm.io
Also called by 1 other listing: ResumeGPT : AI Job Autofill & Best Resume
recruiter-app.zoominfo.com
Also called by 5 other listings, including PCR Capture, Ebsta for Bullhorn

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Service worker re-enables browser-wide third-party cookies on every startup

Every time its background service worker starts, the extension checks whether third-party cookies are disabled and, if it can, turns them back on for your whole browser, not just for Recruit CRM's own sites.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You (or your organization) turn off third-party cookies in Chrome.

Chrome reports the setting as controllable_by_this_extension or controlled_by_this_extension.

The extension did this

The extension's service worker reads that setting at startup and turns it back on for the whole browser.

No per-site prompt or extension UI asks first.

The code that does this

The startup check that flips the browser setting

Readable version
chrome.privacy.websites.thirdPartyCookiesAllowed.get({}, function (setting) {  if (!setting.value) {    if (setting.levelOfControl == 'controllable_by_this_extension' ||        setting.levelOfControl == 'controlled_by_this_extension') {      chrome.privacy.websites.thirdPartyCookiesAllowed.set({ 'value': true });    } else {      errorRunExtension = true;    }  }});
What's stored on your device

Turning the setting off and restarting the service worker was enough to see it flipped back on, unprompted.

Location
chrome.privacy.websites.thirdPartyCookiesAllowed (browser-wide Chrome setting)
Contents
{  "after_forced_restart": {    "value": true,    "levelOfControl": "controlled_by_this_extension"  },  "before_forced_restart": {    "value": false,    "levelOfControl": "controlled_by_this_extension"  }}
When this fires

On every browser startup

Runs every time the service worker starts, which includes browser launch, extension reload, and Chrome's normal service-worker wake cycles, not only first install.

Who benefits when this setting is forced on
    • any third-party site you visit

    Gains the ability to set and read third-party cookies on your browser, unrelated to Recruit CRM.

Updated 30 September 2026pabamgafdnanldcgdhpfohfdpjjbekom