Is Speed Dial safe?
Speed Dial fetches a remote affiliate code on install, appends it to Yahoo searches, and screenshots bookmarked pages in hidden windows.
When first installed, the extension contacts addonsearch.net to retrieve a partner tracking code ('ref') and stores it locally. Every search submitted through the new tab page is routed through Yahoo with hardcoded partner identifiers and the remotely fetched ref value appended. The extension also opens off-screen 10×10 browser windows at off-screen coordinates and uses tabs.captureVisibleTab to take screenshots of bookmarked URLs, which may include authenticated page state.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Speed Dial captures off-screen page screenshots for bookmark previews.
Adding/editing a bookmark, or when one lacks a preview, Speed Dial opens the URL in an off-screen popup and screenshots it for the tile.
The preview can include the page URL and content, including authenticated state if logged in.
What actually happens
The user adds or edits a bookmark, or opens the new-tab page with a saved bookmark that lacks a preview.
Speed Dial opens the bookmark URL off-screen, captures the visible tab, and saves the PNG data as the tile preview.
Fields included in the captured preview
- Page URLhttps://mail.example.com/inbox (illustrative)
Identifies which bookmarked page was opened for the preview capture.
- Visible page contentSigned-in dashboard preview image (illustrative)
Shows what was visible in the opened page, which can include signed-in content when the browser profile is already logged in.
Observation
Dynamic analysis confirmed the extension has broad URL and tab permissions and uses an off-screen popup with visible-tab capture to generate bookmark preview images.
What it can do
Permissions this extension asks for, as declared in version 1.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
See the address and title of every tab you have open
tabs
Read and change your full browsing history
history
Store an unlimited amount of data in your browser
unlimitedStorage
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Read the sites you visit most
topSites
Act on the current tab, but only after you click the extension
activeTab
Watch every request your browser makes
webRequest
Watch, block and rewrite every request your browser makes
webRequestBlocking
Where it sends data
Destinations our analysis observed Speed Dial contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- search.yahoo.comwidely used
Speed Dial sends data to search.yahoo.com. A widely used service: 39 other extensions we have analyzed send data here.
- www.bing.comwidely used
Speed Dial sends data to www.bing.com. A widely used service: 29 other extensions we have analyzed send data here.
- www.addonsearch.net
Speed Dial sends data to www.addonsearch.net. 2 other extensions we have analyzed send data here.