Is Web Search safe?

Medium risk

Web Search redirects default searches with a persistent extension GUID to search.websearchextension-api.info.

When Web Search is installed, it sets itself as the browser's default search provider and adds a redirect rule for searches sent through its search URL. The redirect forwards the search terms together with a stored extension GUID to search.websearchextension-api.info.

websearchextensionnow10v1.21.1214Chrome Web Store
47Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Web Search attaches a persistent ID to every search you make

Web Search sets itself as your default search engine, its stated purpose.

But every search you run through it is also redirected with a persistent ID created at install, letting the vendor link your searches to this device.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You type a search into the address bar using Web Search, the extension's default search provider.

The extension did this

The extension redirects your search to its own server with your search term and a persistent install ID attached.

That ID was generated once, right after install, and is reused on every search from then on.

What's in the redirected search request
  • Your search term
    k=dynamic%20analysis%20test%20query

    The exact text you typed is forwarded to the vendor before your results load.

  • A persistent device ID
    guid=02139c18-5600-6088-1ada-d542b6fe6149

    Generated once at install and reused on every search, letting the vendor link a history of your searches to one device.

  • Redirect purpose code
    action=ds

    A fixed tag marking the request as a default-search redirect.

Captured request
GEThttps://search.websearchextension-api.info/crx/search.php?k=dynamic%20analysis%20test%20query&action=ds&guid=02139c18-5600-6088-1ada-d542b6fe6149
The code that does this

The redirect rule that attaches the ID

Readable version

Same source, annotated (this file ships unminified, no deobfuscation step was needed)

lib/ext.js:178-198
// guid was fetched from api.websearchextension-api.info/api/v2/json/install// at install time and stored in chrome.storage.sync.const guid = await getSetting("guid", true);chrome.declarativeNetRequest.updateDynamicRules({    removeRuleIds: [1],    addRules: [{        id: 1,        priority: 1,        action: {            type: "redirect",            redirect: {                // \1 is the search term captured by regexFilter below.                // guid is the same persistent value on every rewrite.                regexSubstitution:                    `https://search.${this.config.apiDomain}/crx/search.php?k=\\1&action=ds&guid=${guid}`,            },        },        condition: {            // Matches any navigation through this extension's own default            // search endpoint.            regexFilter: `https://search.${this.config.apiDomain}/search/(.*)`,            isUrlFilterCaseSensitive: false,            resourceTypes: ["main_frame"],        },    }],});
Vendor subdomains this extension talks to
    • search.websearchextension-api.info

    Receives your search term and persistent ID on every default-search redirect.

    • api.websearchextension-api.info

    Issues the persistent ID during setup, right after install.

    • meta.websearchextension-api.info

    Receives search-suggestion queries as you type in the address bar.

    • uninstall.websearchextension-api.info

    Receives the persistent ID again if the extension is removed.

What it can do

Permissions this extension asks for, as declared in version 1.21.1214. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on websearchextension-api.info

    *://*.websearchextension-api.info/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Run searches with your default search engine

    search

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Add items to the right-click menu

    contextMenus

Where it sends data

Destinations our analysis observed Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • search.websearchextension-api.info

    Search sends data to search.websearchextension-api.info. No other extension we have analysed sends data here.

Updated 30 September 2026pdlbaeociiihlkdclgjnmdpabmpkdgka