Is Spaulding Computer Web Defender safe?
Spaulding Computer Web Defender redirects your browser on every site visited, using rules fetched unencrypted from its own server.
On every page load, the extension checks the URL against a redirect-rule list it downloads from its own server and, on a match, sends the tab to a destination taken directly from that list with no built-in check that the destination is actually a malware or phishing site. The rule list is refreshed on browser startup, on every toolbar click, and every two days, and is fetched over plain HTTP rather than HTTPS, so anyone able to intercept that connection (a rogue Wi-Fi network, a compromised router, or an ISP) could substitute their own rules and redirect the user's browsing instead.
Who publishes itSafety Redirector, LLC. - 6 other listings from the same operator, 1 of them carrying a finding
Safety Redirector, LLC. - 6 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 9k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Safety Redirector redirects your browsing to server-picked URLs, no allowlist
Code analysis shows the background service worker redirects your active tab to a URL supplied by the vendor's server on any page matching a served pattern, with no local check limiting the destination to a vetted category of site.
What actually happens
You navigate to any HTTP or HTTPS page while this extension is installed.
The listener applies everywhere because host_permissions covers http://*/* and https://*/*.
The service worker checks the page against a rule list from the vendor's server and redirects your tab on a match.
The redirect destination is taken directly from the fetched rule, with no local check restricting it to a vetted category of site.
The code that does this
The navigation listener and its redirect handler
Navigation listener (registered for every site)
js/main.jschrome.webNavigation.onBeforeNavigate.addListener((tab) => { ruleExists(tab, tab.url);});setTimeout(refreshRules, 2 * 86400000); // Refresh rules every 2 daysRule match and redirect
js/main.jsfunction ruleExists(tab, url) { let testURL = prepareUrl(url); chrome.storage.local.get(['rules', 'freq_track'], (result) => { let rules = result.rules || {}; let freqTracks = result.freq_track ? JSON.parse(result.freq_track) : {}; for (const i in rules) { let ruleData = JSON.parse(rules[i]); let from = i.substr(0, i.indexOf('_')); let regx = new RegExp('^' + from.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$'); if (regx.test(testURL)) { let checkRule = true; if (ruleData[3] === 'once' && freqTracks[i] !== undefined) checkRule = false; if (ruleData[3] === 'per24') { let checkDate = new Date(); checkDate.setHours(checkDate.getHours() - 24); if ((new Date(freqTracks[i])) > checkDate) checkRule = false; } if (checkRule) { let newUrl = (/^https?:\/\//.test(ruleData[0]) ? '' : 'http://') + ruleData[0]; chrome.tabs.update(tab.tabId, { url: newUrl }); } break; } } });}Rule format bundled with the extension (illustrative, unused sample)
- Pattern to match123.com (illustrative)
The site-address pattern that has to match before a redirect fires.
- Redirect destinationhttps://yahoo.com (illustrative)
Where your active tab is sent once the pattern matches. No category or safety check applies.
- Frequency limitonce (illustrative)
How often this one rule is allowed to fire: once ever, once per 24 hours, or unlimited.
Where the live rule set comes from
- www.rules.safetyredirector.com
Serves the redirect-rule feed that decides where matching navigations get sent; no allowlist restricts destinations to a vetted category of host.
Reproduce it yourself
Fetches the vendor's live redirect-rule feed and prints every pattern-to-destination pair it currently serves.
- Node.js 18+
// check_live_rules.js// Fetches the extension's live redirect-rule feed and prints every// pattern -> destination pair it currently serves.const RULES_URL = "http://www.rules.safetyredirector.com/url_redirect3.php";async function main() { const res = await fetch(RULES_URL); if (!res.ok) { console.error(`Fetch failed: HTTP ${res.status}`); process.exit(1); } const rules = await res.json(); const keys = Object.keys(rules); console.log(`Server returned ${keys.length} rule(s).`); for (const key of keys) { const parsed = JSON.parse(rules[key]); const redirectTo = parsed[0]; const frequency = parsed[3]; const pattern = key.split("_")[0]; console.log(`pattern="${pattern}" -> redirect="${redirectTo}" frequency="${frequency}"`); }}main().catch((err) => { console.error(err); process.exit(1);});- 1Run node check_live_rules.js (Node 18+).
- 2Review the printed pattern and redirect pairs.
- 3Confirm none are scoped to a vetted destination allowlist.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 8.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
See every page you navigate to, as you navigate to it
webNavigation
Store data in your browser
storage
Show you desktop notifications
notifications
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed Spaulding Computer Web Defender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.rules.safetyredirector.com
Spaulding Computer Web Defender sends data to www.rules.safetyredirector.com. 4 other extensions we have analyzed send data here.