Is Search All safe?

Medium risk

Search All routes Amazon and eBay searches through affiliate links and injects a promotional iframe into Google results.

When a user runs an Amazon search through the extension, the URL is rewritten to include a hardcoded affiliate tag ('diigo0c-20'). eBay and Newegg searches are routed through the go.redirectingat.com affiliate redirector. On Google search pages, the extension also inserts a sider.ai promotional iframe into the results sidebar on each navigation, which the user can dismiss to suppress future appearances.

Screen Recorderv2.2.30Chrome Web Store
48Risk
Who publishes it

Screen Recorder - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Screen Recorder

Same store account

2 other listings published from this account, 4.5M+ users between them, none of them carrying a finding.

Shared hosts - 10 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

ebookee.org
Also called by 2 other listings
paoniu8.blogbus.com
Also called by 2 other listings, including Diigo Web Collector - Capture and Annotate
pricegrabber.com
Also called by 2 other listings
pricewatch.com
Also called by 2 other listings
s.etao.com
Also called by 2 other listings, including Diigo Web Collector - Capture and Annotate
search.360buy.com
Also called by 2 other listings: Diigo Web Collector - Capture and Annotate, Diigo Web Collector - Capture and Annotate
searcho.com
Also called by 2 other listings: Diigo Web Collector - Capture and Annotate, Diigo Web Collector - Capture and Annotate
shopping.com
Also called by 2 other listings: Diigo Web Collector - Capture and Annotate, Diigo Web Collector - Capture and Annotate
zurb.com
Also called by 4 other listings
foodnetwork.com
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search All adds a Sider.ai frame to Google results

MediumunwantedCWE-506Dynamic sandbox

On a Google search results page, Search All checks a promotion flag, then prepends a Sider.ai iframe into the results column.

What actually happens

You did this

You load a Google search results page.

The extension did this

The extension adds a Sider.ai recommendation frame to the results sidebar when its promotion flag is still enabled.

The frame is added to the page before the extension checks whether its own search bar should be shown.

Concrete fields used for the remote iframe request

  • Remote host
    sider.ai

    This is the outside site loaded inside your Google results page.

  • Campaign source
    source=sa&p1=gside

    This labels the frame load as coming from the Search All extension integration.

  • Browser family
    p2=chrome

    This tells the landing page whether the extension is running in Chrome or Edge.

  • Page condition
    https://www.google.com/search?q=weather

    The behavior is tied to Google result-page navigation, so the frame load occurs in that browsing context.

Captured request

GEThttps://sider.ai/search-landing?source=sa&p1=gside&p2=chrome

Page DOM modified

The extension prepends a promotional iframe and a dismissal control into the Google results sidebar.

Target
the right-side column of Google search results
Before
<div id="rhs"></div>
After the extension changed it
<div id="rhs">  <div id="pDiv" style="margin-bottom: 20px;">    <iframe src="https://sider.ai/search-landing?source=sa&p1=gside&p2=chrome" style="border: none;"></iframe>    <div id="promotion-stop-btn">Stop seeing this recommendation</div>  </div></div>

The code that does this

The shipped code path that inserts the Sider.ai frame

Readable version

Google tab navigation triggers a content-script message

js/serviceWorker.js
chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {  console.log("update", tabId, changeInfo, tab);  if (changeInfo.status == "loading") return;  var host = tab.url;  var hostmatch = host.match(/\.(.*?)\./);  var hostname;  console.log("hostmatch", hostmatch);  if (hostmatch == null) {    if (host.match(/(.*?)\./)) {      hostname = host.match(/(.*?)\./)[1];    }  } else {    hostname = hostmatch[1];  }  console.log(hostname);  if (hostname) {    if (hostname == "google") {      //chrome.tabs.executeScript(tabId, {file: 'js/contentscript.js'});      chrome.tabs.sendMessage(tabId, { action: "tabupdate" }).catch(() => {});    }    chrome.tabs.sendMessage(tabId, { action: "startdetect" }).catch(() => {});    chrome.tabs.sendMessage(tabId, { action: "insertChango" }).catch(() => {});  }});

The content script asks whether the promotion should be shown

js/contentscript.js
addbar: function () {  //console.trace();  HOST = window.location.host;  URL = window.location.href;  //var query = Search.issearch(HOST,URL);  //if(query.query){  //    ISSEARCH = true;  //    if(OPTION.switchbar=='false') return;  //    this.showbar(query.query,query.hostname);  //}  chrome.runtime.sendMessage({ action: "getPromotion" }, function (response) {    if (response) {      addPromotion();    }  });  if (OPTION.switchbar == "false") return;  chrome.runtime.sendMessage({ action: "getsearchs" }, function (response) {    var searchs = response.searchs;    console.log("searchs", searchs);    var queryHistory = response.querys;    //console.log(queryHistory);    for (i = 0; i < searchs.length; i++) {      var cachehost = searchs[i]["searchurl"].match(/\/\/(.*?)\//)[1];      if (HOST == cachehost || $.inArray(HOST, googleSites) != -1) {        if (/google\.(.*)\/maps/.test(URL)) {          return;        }        var querykey = searchs[i]["searchurl"].match(          /[&|\?]([-\=\w]+)\{%s\}/        );        if (querykey) {          querykey = querykey[1];        } else {          querykey = "special";        }        //console.log(querykey);        Search.removebar();        var searchUrl = searchs[i]["searchurl"];        Search.showbar(searchs, querykey, cachehost, queryHistory, searchUrl);        break;      }    }    //Search.showbar(searchs); //for test  });}

The background page enables the promotion unless the user dismissed it

js/bg.js
case "closePromotion":  localStorage["promotion"] = false;  break;case "getPromotion":  sendResponse(localStorage["promotion"] !== "false");  break;

The content script constructs and prepends the Sider.ai iframe

js/contentscript.js
function addPromotion() {  var pDiv = document.getElementById("pDiv");  if (pDiv) {    return;  }  var pDiv = document.createElement("div");  var iframe = document.createElement("iframe");  iframe.src =    "https://sider.ai/search-landing" +    "?source=sa&p1=gside&p2=" +    (/Edg/.test(navigator.userAgent) ? "edge" : "chrome");  iframe.style.border = "none";  pDiv.id = "pDiv";  pDiv.style.marginBottom = "20px";  pDiv.appendChild(iframe);  var stopBtn = document.createElement("div");  stopBtn.id = "promotion-stop-btn";  stopBtn.innerText = "Stop seeing this recommendation";  stopBtn.addEventListener("click", function () {    chrome.runtime.sendMessage({ action: "closePromotion" });    pDiv.style.display = "none";  });  pDiv.appendChild(stopBtn);  var col = document.getElementById("rhs");  if (col) {    col.prepend(pDiv);  }  window.addEventListener("message", function (event) {    console.log("messages", event);    if (      event.origin === "https://dev.wisehood.ai" ||      event.origin === "https://sider.ai"    ) {      if (event.data.width) {        iframe.width = event.data.width;      }      if (event.data.height) {        iframe.height = event.data.height;      }    }  });}

External host loaded by the inserted frame

    • sider.ai

    Receives the iframe page load for /search-landing with source=sa, p1=gside, and p2 set from the browser family.

    • dev.wisehood.ai

    Allowed as a postMessage origin for resizing messages to the inserted iframe, alongside sider.ai.

What it can do

Permissions this extension asks for, as declared in version 2.2.30. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on images.google.com

    *://*.images.google.com/

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Read and change your bookmarks

    bookmarks

  • Read and change your full browsing history

    history

  • Run hidden pages in the background

    offscreen

  • Act on the current tab, but only after you click the extension

    activeTab

favicon

Where it sends data

Destinations our analysis observed Search All contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.amazon.com

    Search All sends data to www.amazon.com. 9 other extensions we have analyzed send data here.

  • go.redirectingat.com

    Search All sends data to go.redirectingat.com. No other extension we have analyzed sends data here.

  • sider.ai

    Search All sends data to sider.ai. No other extension we have analyzed sends data here.

Updated 30 September 2026kpdkbemdpepjjppbfgeapjienologapa