Is Safety Redirector Pro safe?

Medium risk

Safety Redirector Pro is medium risk. Code analysis shows the background worker checks every page you navigate to against a rule list fetched from the vendor's server, and on a host match, redirects your tab to whatever URL that rule specifies, on any site.

Safety Redirector, LLC.v8.0.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI FOUND

Extension redirects any page you load per a remotely fetched rule list

Code analysis shows the background worker checks every page you navigate to against a rule list fetched from the vendor's server, and on a host match, redirects your tab to whatever URL that rule specifies, on any site.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You type or click a link to any http:// or https:// site.

The extension did this

The worker matches the host against a remotely supplied rule list and redirects your tab to that rule's target URL instead of the page you requested.

The redirect target, and whether it fires at all, is decided by whatever the vendor's server last returned, not by a fixed known-bad-site list.

02EvidenceCODE COMPARE
The code that does this

The navigation hook and the redirect logic

What it actually does
Registers the navigation hookjs/main.js
chrome.webNavigation.onBeforeNavigate.addListener((tab) => {
    ruleExists(tab, tab.url);
});

setTimeout(refreshRules, 2 * 86400000); // Refresh rules every 2 days
Matches the rule and redirectsjs/main.js
function ruleExists(tab, url) {
    let testURL = prepareUrl(url);

    chrome.storage.local.get(['rules', 'freq_track'], (result) => {
        let rules = result.rules || {};
        let freqTracks = result.freq_track ? JSON.parse(result.freq_track) : {};

        for (const i in rules) {
            let ruleData = JSON.parse(rules[i]);
            let from = i.substr(0, i.indexOf('_'));
            let regx = new RegExp('^' + from.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');

            if (regx.test(testURL)) {
                let checkRule = true;

                if (ruleData[3] === 'once' && freqTracks[i] !== undefined) checkRule = false;
                if (ruleData[3] === 'per24') {
                    let checkDate = new Date();
                    checkDate.setHours(checkDate.getHours() - 24);
                    if ((new Date(freqTracks[i])) > checkDate) checkRule = false;
                }

                if (checkRule) {
                    let newUrl = (/^https?:\/\//.test(ruleData[0]) ? '' : 'http://') + ruleData[0];
                    chrome.tabs.update(tab.tabId, { url: newUrl });
                }
                break;
            }
        }
    });
}
03EvidenceFIELD TABLE
What one fetched rule record contains
FieldValueWhy it matters
Site pattern
test.comThe host pattern this rule matches against, turned into a wildcard regex.
Redirect target
https://safe-test.comThe full URL your tab is sent to instead of the page you requested.
Frequency
per24How often this rule can fire again for the same host: once, or once per 24 hours.
04EvidenceTEMPORAL PATTERN
When this fires
Every 2 days

Refetches the rule list from the vendor's server every 2 days, in addition to on every browser startup.

05EvidenceARTIFACT
Reproduce it yourself

Recreates the extension's rule-matching logic against a sample rule list so you can see which hosts would trigger a redirect.

RequiresNode.js 18+
rule-match-demo.js · js
// rule-match-demo.js
// Recreates ruleExists() from js/main.js so you can test which hosts a
// fetched rule list would redirect, without installing the extension.

const fs = require('fs');

function prepareUrl(url) {
  return url
    ? url.replace(/\/$/, '').replace(/^http:\/\/|https:\/\//, '').replace(/^www\./, '')
    : '';
}

function matchRule(rules, url) {
  const testURL = prepareUrl(url);
  for (const key in rules) {
    const ruleData = JSON.parse(rules[key]);
    const from = key.substr(0, key.indexOf('_'));
    const regx = new RegExp('^' + from.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
    if (regx.test(testURL)) {
      const target = (/^https?:\/\//.test(ruleData[0]) ? '' : 'http://') + ruleData[0];
      return { matchedPattern: from, frequency: ruleData[3], redirectTo: target };
    }
  }
  return null;
}

const rulesPath = process.argv[2];
const url = process.argv[3];
const rules = JSON.parse(fs.readFileSync(rulesPath, 'utf8'));
const result = matchRule(rules, url);
console.log(result ? `MATCH: ${JSON.stringify(result)}` : 'No rule matches this URL.');
How to run it
  1. 1
    Save as rule-match-demo.js.
  2. 2
    Run node rule-match-demo.js rules.json https://example.com.
  3. 3
    It prints whether a rule matches and where the tab would be sent.
06EvidencePLAIN NOTE
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 20 September 2026jnmhccjkkceapbekdaoonmakomoanapl