Is Search Manager safe?

High risk

Search Manager is high risk. Search Manager overrides your default search engine, routing searches through eaburl.com, a monetization domain. It then redirects to srchinggpack.com with query terms visible in the URL. Engine changes are also signaled to eaburl.com.…

IM doov1.7.23Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Search Manager routes all queries to eaburl.com without disclosure

Search Manager overrides your default search engine, routing searches through eaburl.com, a monetization domain.

It then redirects to srchinggpack.com with query terms visible in the URL.

Engine changes are also signaled to eaburl.com.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You type a search query into the browser address bar.

The extension did this

Search Manager redirects the query through eaburl.com, which forwards it to srchinggpack.com with your search terms in the URL.

This happens for every search from the moment of installation, no user interaction beyond the initial install is required.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://srchinggpack.com/?a=gsp_imdownloaderb_26_16_ssg00&q=<search+query>
200 OK, search results page served by srchinggpack.com (eaburl.com affiliate partner)
03EvidenceFIELD TABLE
What eaburl.com receives with each search:
FieldValueWhy it matters
Your search query
symptoms of high blood pressureThe exact text you typed in the address bar, sent in plaintext to a third-party domain.
Vendor referral code
vnd=1A hardcoded affiliate parameter identifying this extension as the traffic source, enabling revenue tracking.
Affiliate tracking parameter
a=gsp_imdownloaderb_26_16_ssg00A secondary code passed on to the final search domain, used to attribute and monetize the search query.
04EvidenceCODE COMPARE
The code that does this

The manifest declaration that overrides the default search engine:

What it actually does
What the manifest block does
// Manifest declares a custom search provider with is_default: true.
// This replaces the user's configured default search engine (Google, Bing, etc.)
// with eaburl.com for all omnibox queries, without asking for explicit consent.
// The vnd=1 referral parameter is always appended — all queries are monetized.
Engine preference beacon — fires on install and on every change
// Called on extension install (via onInstalled) and on every context-menu
// search-engine change. Sends the chosen engine ID (e.g. 'yahoo', 'google',
// 'bing') to eaburl.com as a preference signal with the vendor referral param.
function signalSearchEngineChange(searchEngineId) {
    return fetch('https://eaburl.com?vnd=1&esec=' + searchEngineId);
}
05EvidenceTHIRD PARTY LIST
Where search queries are routed:
  • eaburl.com

    First hop for search queries. Receives the raw query via search_url and redirects to the affiliate partner. Also receives engine preference changes via signalSearchEngineChange.

  • srchinggpack.com

    Destination search provider. Receives the query with an affiliate tracking code (gsp_imdownloaderb_26_16_ssg00) embedded, enabling revenue attribution to this extension.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Search Manager sends search choices to eaburl.com

Processing a search-engine menu selection makes Search Manager store the provider ID and send it to eaburl.com as esec.

The same function sends the stored provider at setup.

No request body captured; earlier attempts missed these paths.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You choose a search provider from the extension menu.

The available menu choices in the shipped code are Yahoo, Google, and Bing.

The extension did this

The extension stores that choice and sends the selected provider ID to eaburl.com.

The request uses the esec query parameter with values such as google, yahoo, or bing.

02EvidenceFIELD TABLE
Fields in the outbound request
FieldValueWhy it matters
Your selected search provider
googleShows which search provider you chose inside the extension.
Extension request marker
vnd=1Marks the request as coming from this extension flow rather than from normal page browsing.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://eaburl.com?vnd=1&esec=google
04EvidenceCODE COMPARE
The code that does this

The service worker stores the selection and sends it to eaburl.com

What it actually does
Provider IDs and storage keybackground.js
let searchEnginesContainer = new SearchEnginesContainer();
//searchEnginesContainer.add(new SearchEngine('Default', 'default'))
searchEnginesContainer.add(new SearchEngine('Yahoo!', 'yahoo'))
searchEnginesContainer.add(new SearchEngine('Google', 'google'))
searchEnginesContainer.add(new SearchEngine('Bing', 'bing'))
let searchEngines = searchEnginesContainer.getEnginesArray()
//* storage
const DEFAULT_SEARCH_ENGINE = 'yahoo'
function getSearchEngine() {
	return new Promise((resolve, reject) => {
		chrome.storage.sync.get('srinmsearchengine', function(result) {
			resolve(result.srinmsearchengine)
	    });
	});
}
function setSearchEngineStorage(searchEngine) {
	chrome.storage.sync.set({'srinmsearchengine': searchEngine});
}
Outbound signal and callersbackground.js
function signalSearchEngineChange(searchEngineId) {
	return fetch('https://eaburl.com?vnd=1&esec=' + searchEngineId);
}
function searchEngineChange(data, tab) {
	let searchEngineId = data.menuItemId

	searchEngineUpdateUI(searchEngineId);

	setSearchEngineStorage(searchEngineId);

	signalSearchEngineChange(searchEngineId);
}

chrome.runtime.onInstalled.addListener(function(details) {
setupSearchEngineContextMenu()
.then(() => uncheckAllUIPromise())
.then(() => getSearchEngine())
.then((searchEngine) => checkEnginePromise(searchEngine))
.then((searchEngine) => signalSearchEngineChange(searchEngine));
});
chrome.contextMenus.onClicked.addListener(function(info, tab) {
	searchEngineChange(info, tab);
});
05EvidenceTHIRD PARTY LIST
External host that receives the preference signal
  • eaburl.com

    Receives the selected search-provider ID in the esec query parameter and is also configured as the extension search-provider host.

Updated 10 September 2026anjmlknodakgoomjeifkbcfbcpgonefk