Is Search Tool (AI) safe?

Medium risk

Search Tool (AI) sends matched history and bookmark domains to icon.horse when showing popup suggestions.

When you type in the extension popup, it searches your browser history and bookmarks for matching entries. For each match, it loads a favicon from icon.horse using the matched site's hostname, which sends those domains to icon.horse.

Robin Linv1.3.1Chrome Web Store
46Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

History and bookmark domains are requested from icon.horse in suggestions

Typing in the popup makes Search Tool (AI) search your Chrome history and bookmarks.

For each result it requests a favicon from icon.horse using the matched hostname, exposing history, bookmark, and URL context to that third party.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

User types a search query in the extension popup.

The extension did this

The extension searches history and bookmarks, extracts matched hostnames, and builds suggestion icons that request those hostnames from icon.horse.

Captured request
GEThttps://icon.horse/icon/<hostname>
Fields in the request
  • Browsing history site
    example.com (illustrative)

    Shows a site from your browser history that matched the popup query.

  • Bookmarked site
    docs.example.com (illustrative)

    Shows a site saved in your bookmarks that matched the popup query.

  • Matched page URL hostname
    news.example.com (illustrative)

    Identifies the domain used to request a favicon from the third-party service.

Observation

Dynamic analysis confirmed the extension grants history and bookmarks access and builds icon.horse favicon URLs from matched history or bookmark result hostnames.

What it can do

Permissions this extension asks for, as declared in version 1.3.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Add items to the right-click menu

    contextMenus

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Read and change your full browsing history

    history

  • Read and change your bookmarks

    bookmarks

Where it sends data

Destinations our analysis observed Search Tool (AI) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • icon.horse

    Search Tool (AI) sends data to icon.horse. One other extension we have analysed sends data here.

Updated 30 September 2026fjjkihnjlinkjpfeooipegebcakeocef