Is Spotify Web Player Search safe?

Medium risk

Spotify Web Player Search sets chromecrxstore.com as Chrome's default search provider.

The extension's manifest replaces Chrome's default search engine with one named "Internet" that points to chromecrxstore.com. Every address-bar search, and each keystroke for suggestions, is sent to that host. The store description only mentions a Spotify search keyword ("spo"), not the search change.

Jesse Whitev1.0.1Chrome Web Store
49Risk
Who publishes it

Jesse White - 7 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Jesse White

Same store account

7 other listings published from this account, 38k+ users between them. 6 of them carry a finding.

Quick Spotify Search: Instant Music & Podcast Finder20k+MediumAmazon Search Pro: Right-Click, Popup & Omnibox (ALL COUNTRIES!)10k+MediumYouTube Music Web Player Search6k+MediumApple Music(iTunes) Web Player2k+MediumApple TV Search362MediumPrivate Search Online — Auto History Wipe13Low1 more listing in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Spotify search extension sets chromecrxstore.com as your default search engine

Code analysis shows the manifest sets chromecrxstore.com as the default search provider, so address-bar queries and suggestions go there.

The listing only describes Spotify search.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You type a query into the browser address bar after installing the extension.

The extension did this

Your text is sent to chromecrxstore.com for suggestions and search, not to your previous search engine.

The code that does this

Search provider override in manifest.json

Readable version

Same block; manifest is not obfuscated

manifest.json
{    "chrome_settings_overrides": {        "search_provider": {            "name": "Internet",            "keyword": "cse",            "search_url": "https://chromecrxstore.com/query/index.html?q={searchTerms}",            "favicon_url": "https://chromecrxstore.com/query/icon.jpg",            "suggest_url": "https://chromecrxstore.com/suggest.php?q={searchTerms}",            "encoding": "UTF-8",            "is_default": true        }    }}
What the search provider declaration sets
  • Search URL
    https://chromecrxstore.com/query/index.html?q=weather+tomorrow

    Where your address-bar searches are sent, with your terms included.

  • Suggest URL
    https://chromecrxstore.com/suggest.php?q=weath

    Receives your text as you type, before you press Enter.

  • Provider name
    Internet (keyword: cse)

    Shown to you as a generic label unrelated to Spotify.

  • Default flag
    is_default: true

    Makes this provider your default search engine.

Where search data goes
    • chromecrxstore.com

    Receives search and suggestion queries. Unrelated to Spotify; operator not named in the listing.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Spotify Web Player Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromecrxstore.com

    Spotify Web Player Search sends data to chromecrxstore.com. 13 other extensions we have analysed send data here.

Updated 15 October 2026klbmallgiemiofpknobjmpbpjndphedc