Am I Being Pwned?
Get started

Is SEMRush Rank safe?

Medium risk

SEMRush Rank transmits the full URL of each visited tab to rank.trellian.com on every page load and tab switch.

Each time you activate a tab or finish loading a page, the extension captures the full URL — including path and query string — and sends it to rank.trellian.com as a query parameter. Only the scheme and 'www.' prefix are stripped before transmission. A 20-slot in-memory cache prevents duplicate requests for the same hostname, but any hostname not recently seen is sent unconditionally.

trellian-devsv1.7Chrome Web Store
45Risk
Who publishes it

Trillion - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
trellian-devs
Declared legal entity
Trillion
Registered address
8 E Concourse, Beaumaris, VIC 3193, AU
Registered contact
Trillion
Website
www.toolbarbrowser.com/contact.htm

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Full tab URLs sent to Trellian for rank lookups

MediumunwantedCWE-359Dynamic sandbox

On tab open, reload, or switch, SEMRush Rank sends the active tab URL to rank.trellian.com/add.txt, stripping only the scheme and leading www., so paths and queries remain.

What actually happens

You did this

You open, reload, or switch to a browser tab.

The extension did this

The extension sends the current tab address to Trellian when its local rank cache does not already have that host.

The code keeps a 20-entry host cache, so first visits and cache misses cause the request.

Captured request

GEThttps://rank.trellian.com/add.txt?sid=semrush&url=chrome-extension://idbhoeaiokcojcgappfigpifhpkjgmab/options.html

Dynamic analysis observed the request while active-tab URL hooks ran before rank requests.

Fields sent in the Trellian request

  • Current tab address
    chrome-extension://idbhoeaiokcojcgappfigpifhpkjgmab/options.html

    Reveals the exact page you had open, not just the site name. Search terms or query values in the address stay in the value sent.

  • Path and query string
    example.com/account/transfer?token=abc123 (illustrative)

    The extension keeps the part of the address after the hostname, which can expose what you viewed or searched for on a site.

  • Source tag
    sid=semrush

    The request labels the lookup as coming from the SEMRush Rank extension integration.

The code that does this

The shipped code reads the active tab URL and appends it to the Trellian request

Readable version

Rank request builder

background.js
semrush_rank: function () {			//xml url	    var service_url = 'https://rank.trellian.com/add.txt?sid=semrush&url=';		var host = this.getHost(selectedUrl);		var url = this.getUrl();		var popularity = -1;                		if(selectedUrl.match('^about:') || selectedUrl.match('^chrome:') || selectedUrl == '')  {			chrome.action.setBadgeText({"text": ''});					return;		}		var last_use= -1;              		for(var i=0; i<20 && popularity < 0; i++) {				if(semrush_cache[i] == null && last_use == -1) {				last_use =  i;			}			if(semrush_cache[i] && semrush_cache[i][0] && semrush_cache[i][0] == host) {			  popularity = semrush_cache[i][1];			}		  }		  if(popularity < 0) {			fetch(service_url + url).then(response => {				if (response.ok) {					return response.text();				} else {					throw new Error('Network response was not ok.');				}			}).then(text => {				var match = text.match(/[0-9]+/);				var popularity;				if (match) {					popularity = match;				} else {					popularity = "5M";				}				if (popularity >= 5000001 || popularity == 0) {					popularity = "5M";				}				semrush_cache[last_use]=new Array(2);				semrush_cache[last_use][0]=host;				semrush_cache[last_use][1]=popularity;				if(last_use >= 19)					semrush_cache[0] = null;				else					semrush_cache[last_use+1] = null;					            toolBarBrowser.update_semrush_rank(popularity);				});		}		else {			toolBarBrowser.update_semrush_rank(popularity);			}	  }

URL normalizer

background.js
getUrl: function () {		var url = selectedUrl.replace(/^https{0,1}:\/\//,'');		url = url.replace(/^www\./,'');					return url;	}

Navigation triggers

background.js
chrome.tabs.onActivated.addListener(function() {	chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {		selectedId = tabs[0].id;		selectedUrl = tabs[0].url;		chrome.action.setBadgeText({"text": '', tabId: selectedId});		chrome.action.setTitle({title:"SEMRush Rank", tabId: selectedId});		toolBarBrowser.semrush_rank();	});  });chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {	selectedId = tabs[0].id;	selectedUrl = tabs[0].url;	toolBarBrowser.semrush_rank();  });chrome.tabs.onUpdated.addListener(function(tabId, props) {    chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {    		selectedId = tabs[0].id;		selectedUrl = tabs[0].url;		if (props.status == "complete" && tabId == selectedId)			toolBarBrowser.semrush_rank();	});});

Destination receiving the URL value

    • rank.trellian.com

    Receives SEMRush Rank lookup requests at /add.txt with sid=semrush and the current tab address in the url query parameter.

What it can do

Permissions this extension asks for, as declared in version 1.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on rank.trellian.com

    https://rank.trellian.com/

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed SEMRush Rank contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • rank.trellian.com

    SEMRush Rank sends data to rank.trellian.com. No other extension we have analyzed sends data here.

Updated 30 September 2026idbhoeaiokcojcgappfigpifhpkjgmab