Is Safesearch Lab safe?
Safesearch Lab sets itself as the default search engine and routes queries through a tracking redirect before reaching Yahoo.
Once installed, Safesearch Lab takes over the browser's default search provider so that every query typed in the address bar or search box is sent to safesearchlab.com. That request is redirected through api.safesearchlab.com with a static tracking hash and affiliate id, sets tracking cookies, and is then forwarded on to search.yahoo.com for the actual results. The extension has no other code beyond this manifest-level search takeover.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every search you type is routed through an ad-tracking hop before Yahoo
This extension's declared search provider routes every query through an undisclosed tracking redirect before Yahoo results, confirmed with a planted marker and two tracking cookies.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You type a search query into the address bar after this extension becomes your default search engine.
This happens on every search, not only when you open the extension's own popup.
Your query goes to safesearchlab.com, then through an undisclosed ad-tracking redirect before you see real Yahoo results.
The tracking hop is not mentioned anywhere in the extension's Chrome Web Store listing.
- Your search termhttps://safesearchlab.com/search/?q=weather+in+seattle
Whatever you type in the address bar rides along in the URL through every redirect hop.
- Tracking hashh=9f2bdd0dc421701a8763943cf9094da4
A fixed value attached to every search made through this browser, letting the ad network link your searches together over time.
- Affiliate IDsubid2=9400
Tags every search from this extension's install base for revenue-share payouts to whoever distributes it.
- 30-day tracking cookiesc=<session-scoped tracking id>; Max-Age=2592000
Set on the first redirect hop; lets that domain recognize your browser on later visits for a month.
- ~100-day tracking cookiesrdid=<session-scoped tracking id>; Max-Age=8640000
Set on the ad-network hop; persists well beyond a single browsing session.
302 redirect to jmsrchrdr.com, an ad-network redirector, which itself 302s to search.yahoo.com carrying the same query term. The safesearchlab.com hop sets a 30-day cookie; the ad-network hop sets a roughly 100-day cookie.
- safesearchlab.com
Manifest-declared default search provider; receives the full text of every search you type.
- api.safesearchlab.com
Tracking and affiliate redirect not disclosed in the store listing; attaches a static tracking hash and sets a 30-day cookie.
- jmsrchrdr.com
Third-party ad-network redirector not mentioned in the store listing; sets a roughly 100-day cookie.
- search.yahoo.com
Final destination that renders your actual search results, consistent with the store listing's description.
Chrome's confirmation dialog names safesearchlab.com, not Yahoo, when the default search engine changes, so the switch itself is disclosed. It does not mention the tracking redirect and ad-network hop before the Yahoo results.
Where it sends data
Destinations our analysis observed Safesearch Lab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- search.yahoo.comwidely used
Safesearch Lab sends data to search.yahoo.com. A widely used service: 39 other extensions we have analyzed send data here.
- api.safesearchlab.com
Safesearch Lab sends data to api.safesearchlab.com. No other extension we have analyzed sends data here.
- safesearchlab.com
Safesearch Lab sends data to safesearchlab.com. No other extension we have analyzed sends data here.