sults view.","severity":"medium","verificationStatus":"confirmed","timeline":[{"icon":"navigation","actor":"user","label":"Google results","detail":"You navigate to a Google search results page."},{"icon":"service_worker","actor":"service_worker","label":"Tab update","detail":"The extension notices the completed navigation and messages the content script on Google pages."},{"icon":"storage","actor":"extension","label":"Promotion check","detail":"The content script asks whether the recommendation is still enabled; the default answer is enabled."},{"icon":"external_link","actor":"content_script","label":"Frame inserted","detail":"The content script prepends a Sider.ai iframe into the Google results sidebar."},{"icon":"request","actor":"remote","label":"Sider.ai loads","detail":"The browser requests the Sider.ai landing page from inside the injected frame."}],"blocks":[{"kind":"cause_effect","trigger":{"actor":"user","summary":"You load a Google search results page."},"response":{"actor":"content_script","detail":"The frame is added to the page before the extension checks whether its own search bar should be shown.","summary":"The extension adds a Sider.ai recommendation frame to the results sidebar when its promotion flag is still enabled."},"technicalNote":"serviceWorker.js sends {action: \"tabupdate\"} after completed Google tab updates. contentscript.js handles that message by calling Search.addbar(), which asks bg.js for getPromotion and calls addPromotion() when the response is truthy."},{"kind":"field_table","fields":[{"icon":"remote_host","label":"Remote host","meaning":"This is the outside site loaded inside your Google results page.","severity":"context","sampleValue":"sider.ai"},{"icon":"tag","label":"Campaign source","meaning":"This labels the frame load as coming from the Search All extension integration.","severity":"context","sampleValue":"source=sa&p1=gside"},{"icon":"globe","label":"Browser family","meaning":"This tells the landing page whether the extension is running in Chrome or Edge.","severity":"context","sampleValue":"p2=chrome"},{"icon":"url","label":"Page condition","meaning":"The behavior is tied to Google result-page navigation, so the frame load occurs in that browsing context.","severity":"context","sampleValue":"https://www.google.com/search?q=weather"}],"caption":"Concrete fields used for the remote iframe request","technicalNote":"The request URL is assembled in contentscript.js addPromotion() as https://sider.ai/search-landing?source=sa&p1=gside&p2= plus either edge or chrome. The current Google URL is used to trigger the path via tab.url/host checks; it is not appended to the Sider.ai request URL in this code path."},{"url":"https://sider.ai/search-landing?source=sa&p1=gside&p2=chrome","kind":"network_capture","method":"GET","technicalNote":"The extension assigns this URL to iframe.src. No request body is constructed or recorded for this GET request. On Edge, the same code uses p2=edge."},{"kind":"dom_diff","after":"

\n \n

Stop seeing this recommendation

","before":"

","change":"The extension prepends a promotional iframe and a dismissal control into the Google results sidebar.","target":"the right-side column of Google search results","technicalNote":"This DOM fragment reflects the exact elements created by addPromotion(): a div#pDiv, an iframe with the Sider.ai src, and div#promotion-stop-btn. The code inserts pDiv with document.getElementById(\"rhs\").prepend(pDiv)."},{"kind":"code_compare","caption":"The shipped code path that inserts the Sider.ai frame","shipped":[{"code":"chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {\n console.log(\"update\", tabId, changeInfo, tab);\n if (changeInfo.status == \"loading\") return;\n var host = tab.url;\n var hostmatch = host.match(/\\.(.*?)\\./);\n var hostname;\n cons

Is Search All safe?

Findings