Is Search for Perplexity ai safe?

High risk

Search for Perplexity ai sends every keystroke typed in the address bar to perplexity-ai.online, a domain unaffiliated with Perplexity AI.

This extension sets itself as the default browser search provider and points the omnibox autocomplete feature at perplexity-ai.online, a domain registered by the extension's own developer rather than Perplexity AI. Chrome fires that suggest URL as a live request on every keystroke typed in the address bar, before Enter is pressed. The extension's bundled redirect rules only catch the final full-page search request made after pressing Enter, so the address-bar autocomplete traffic goes to perplexity-ai.online unredirected.

proludeyv2.5Chrome Web Store
72Risk
Who publishes it

proludey - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
proludey

Same store account

3 other listings published from this account, 3k+ users between them, none of them carrying a finding.

Remove bg1k+MediumScreenshot on mac1k+MediumCharacter counter1k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search for Perplexity ai sends every keystroke to an unaffiliated domain

Code analysis shows this extension sends every partial query you type in the address bar to perplexity-ai.online, a domain its own developer controls, not Perplexity AI.

The bundled redirect rule never matches these requests.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You type a search into the address bar but haven't pressed Enter yet.

This extension became your browser's default search provider automatically on install.

The extension did this

Chrome sends what you've typed so far to perplexity-ai.online, a domain this extension's developer controls.

The extension's only redirect rule doesn't match this request, so it is never rerouted to perplexity.ai.

What the suggest request sends, before you press Enter
  • Partial search text
    q=how do I reset my rout (illustrative)

    Characters you've typed appear in this request while you're still typing, even if you never press Enter.

  • Request format flag
    output=firefox

    Tells the receiving server to reply in the autocomplete-suggestions format used for address-bar typeahead.

The code that does this

The shipped redirect rule's regex never matches the suggest request

Readable version
// The rule's regexFilter only matches this shape://   https://perplexity-ai.online/search/<query>   resourceType: main_frame// (fires once, when the user presses Enter)// The suggest_url Chrome fires on every keystroke has a DIFFERENT shape://   https://perplexity-ai.online/search?output=firefox&q=<partial query>   resourceType: xmlhttprequest// - no trailing slash before the query string ("/search?" not "/search/")// - resourceType is xmlhttprequest, not main_frame"https://perplexity-ai.online/search?output=firefox&q=weather".match(  /https:\/\/perplexity-ai\.online\/search\/(.*)/)// -> null, no match, no redirect fires// Result: every partial query typed in the address bar reaches// perplexity-ai.online unredirected. Only the final Enter-press// navigation is caught by the rule above.
Where the partial query goes
    • perplexity-ai.online

    Receives every partial query typed in the address bar via suggest_url. Registered by this extension's developer, not Perplexity AI.

Check if you're affected

Tests the extension's shipped redirect rule against a sample suggest_url request and shows it never matches, so the request is never rerouted.

Requires
  • Node.js 18+
check-suggest-redirect.js · js
// check-suggest-redirect.js// Demonstrates that the extension's only declarativeNetRequest rule// (perplexity-rules.json) never matches the live suggest_url requests// Chrome sends on every omnibox keystroke.const rule = {  regexFilter: "https://perplexity-ai\\.online/search/(.*)",  resourceTypes: ["main_frame"]};// A representative suggest_url request Chrome fires while the user types,// built from manifest.json's chrome_settings_overrides.search_provider.suggest_urlconst suggestRequest = {  url: "https://perplexity-ai.online/search?output=firefox&q=weather",  resourceType: "xmlhttprequest"};const re = new RegExp(rule.regexFilter);const urlMatches = re.test(suggestRequest.url);const typeMatches = rule.resourceTypes.includes(suggestRequest.resourceType);console.log("suggest_url request:", suggestRequest.url);console.log("rule regexFilter:", rule.regexFilter);console.log("URL pattern matches rule:", urlMatches);console.log("resourceType matches rule:", typeMatches, `(request is "${suggestRequest.resourceType}", rule only covers ${rule.resourceTypes.join(", ")})`);console.log(urlMatches && typeMatches  ? "Rule would redirect this request."  : "Rule does NOT match. This request reaches perplexity-ai.online unredirected.");
How to run it
  1. 1node check-suggest-redirect.js
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Search for Perplexity ai contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • perplexity-ai.online

    Search for Perplexity ai sends data to perplexity-ai.online. No other extension we have analyzed sends data here.

Updated 30 September 2026flkebkiofojicogddingbdmcmkpbplcd