Is Right Click to Search Any Site: Youtube, Reddit, Wikipedia, Twitter & More safe?
Right Click to Search sets chromecrxstore.com as the default search provider, receiving address-bar queries and suggestions.
The extension adds a context-menu search helper, but its manifest also overrides the browser's default search engine, labelled 'Internet'. Every address-bar search and each keystroke suggestion request is sent to chromecrxstore.com. This override is unrelated to the context-menu feature.
Who publishes itAdBhuT Extensions - 5 other listings from the same operator, 3 of them carrying a finding
AdBhuT Extensions - 5 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
5 other listings published from this account, 194 users between them. 3 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Right-click search extension makes chromecrxstore.com the default search engine
Code analysis shows the manifest sets chromecrxstore.com as the default search provider, so address-bar queries and suggestions go to that host.
This is not mentioned in the store description.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Static analysis
You type a search into the browser address bar.
The query is sent to chromecrxstore.com instead of your previous search engine.
Suggestions are requested from the same host as you type.
Search provider override in the manifest
Stated permissions, for comparison
manifest.json"permissions": [ "contextMenus", "storage" ],- Search queryhttps://chromecrxstore.com/query/index.html?q=cheap+flights+to+lisbon
Everything you type in the address bar and submit.
- Partial queryhttps://chromecrxstore.com/suggest.php?q=cheap+fl
Text typed so far, sent for suggestions.
- chromecrxstore.com
Receives search queries, suggestion requests, and serves the provider icon.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Right Click to Search Any Site: Youtube, Reddit, Wikipedia, Twitter & More contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- chromecrxstore.com
Right Click to Search Any Site: Youtube, Reddit, Wikipedia, Twitter & More sends data to chromecrxstore.com. 13 other extensions we have analysed send data here.