Is SEMRush Rank safe?

Medium risk

SEMRush Rank transmits the full URL of each visited tab to rank.trellian.com on every page load and tab switch.

Each time you activate a tab or finish loading a page, the extension captures the full URL — including path and query string — and sends it to rank.trellian.com as a query parameter. Only the scheme and 'www.' prefix are stripped before transmission. A 20-slot in-memory cache prevents duplicate requests for the same hostname, but any hostname not recently seen is sent unconditionally.

trellian-devsv1.7Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Full tab URLs sent to Trellian for rank lookups

On tab open, reload, or switch, SEMRush Rank sends the active tab URL to rank.trellian.com/add.txt, stripping only the scheme and leading www., so paths and queries remain.

A GET carried the extension's own options-page URL.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open, reload, or switch to a browser tab.

The extension did this

The extension sends the current tab address to Trellian when its local rank cache does not already have that host.

The code keeps a 20-entry host cache, so first visits and cache misses cause the request.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://rank.trellian.com/add.txt?sid=semrush&url=chrome-extension://idbhoeaiokcojcgappfigpifhpkjgmab/options.html
Dynamic analysis observed the request while active-tab URL hooks ran before rank requests.
03EvidenceFIELD TABLE
Fields sent in the Trellian request
FieldValueWhy it matters
Current tab address
chrome-extension://idbhoeaiokcojcgappfigpifhpkjgmab/options.htmlReveals the exact page you had open, not just the site name. Search terms or query values in the address stay in the value sent.
Path and query string
example.com/account/transfer?token=abc123 (illustrative)The extension keeps the part of the address after the hostname, which can expose what you viewed or searched for on a site.
Source tag
sid=semrushThe request labels the lookup as coming from the SEMRush Rank extension integration.
04EvidenceCODE COMPARE
The code that does this

The shipped code reads the active tab URL and appends it to the Trellian request

What it actually does
Rank request builderbackground.js
semrush_rank: function () {
	
		//xml url
	    var service_url = 'https://rank.trellian.com/add.txt?sid=semrush&url=';
		var host = this.getHost(selectedUrl);
		var url = this.getUrl();
		var popularity = -1;        
        
		if(selectedUrl.match('^about:') || selectedUrl.match('^chrome:') || selectedUrl == '')  {
			chrome.action.setBadgeText({"text": ''});		
			return;
		}
		var last_use= -1;              
		for(var i=0; i<20 && popularity < 0; i++) {	
			if(semrush_cache[i] == null && last_use == -1) {
				last_use =  i;
			}
			if(semrush_cache[i] && semrush_cache[i][0] && semrush_cache[i][0] == host) {
			  popularity = semrush_cache[i][1];
			}
		  }
		  if(popularity < 0) {
			fetch(service_url + url).then(response => {
				if (response.ok) {
					return response.text();
				} else {
					throw new Error('Network response was not ok.');
				}
			}).then(text => {
				var match = text.match(/[0-9]+/);
				var popularity;
				if (match) {
					popularity = match;
				} else {
					popularity = "5M";
				}
				if (popularity >= 5000001 || popularity == 0) {
					popularity = "5M";
				}
				semrush_cache[last_use]=new Array(2);
				semrush_cache[last_use][0]=host;
				semrush_cache[last_use][1]=popularity;
				if(last_use >= 19)
					semrush_cache[0] = null;
				else
					semrush_cache[last_use+1] = null;
					
            toolBarBrowser.update_semrush_rank(popularity);	
			});
		}
		else {
			toolBarBrowser.update_semrush_rank(popularity);	
		}
	  }
URL normalizerbackground.js
getUrl: function () {
		var url = selectedUrl.replace(/^https{0,1}:\/\//,'');
		url = url.replace(/^www\./,'');			
		return url;
	}
Navigation triggersbackground.js
chrome.tabs.onActivated.addListener(function() {
	chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {
		selectedId = tabs[0].id;
		selectedUrl = tabs[0].url;
		chrome.action.setBadgeText({"text": '', tabId: selectedId});
		chrome.action.setTitle({title:"SEMRush Rank", tabId: selectedId});
		toolBarBrowser.semrush_rank();
	});  
});

chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {
	selectedId = tabs[0].id;
	selectedUrl = tabs[0].url;
	toolBarBrowser.semrush_rank();  
});

chrome.tabs.onUpdated.addListener(function(tabId, props) {
    chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {    
		selectedId = tabs[0].id;
		selectedUrl = tabs[0].url;
		if (props.status == "complete" && tabId == selectedId)
			toolBarBrowser.semrush_rank();
	});
});
05EvidenceTHIRD PARTY LIST
Destination receiving the URL value
  • rank.trellian.com

    Receives SEMRush Rank lookup requests at /add.txt with sid=semrush and the current tab address in the url query parameter.

Data recipients

rank.trellian.com
Updated 17 September 2026idbhoeaiokcojcgappfigpifhpkjgmab