Is SquarePage safe?

Medium risk

SquarePage is medium risk. We observed that picking Yahoo as your search provider and searching sends your entire settings profile, including your persistent user ID, to SquarePage's own server, then routes the query through an ad affiliate before reaching Yahoo.…

SquareMediav4.1.14Chrome Web Store
49Risk
Who publishes it

Square Media LLC - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
SquareMedia
Declared legal entity
Square Media LLC
Registered address
Church St, Charlotte, NC 28202, US
Registered contact
Chris Harkey
Website
squarestartpage.com/contact

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

search.pdf2docs.com
Also called by 2 other listings, including PDF2DOCS

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SquarePage sends your full settings profile when you search with Yahoo

We observed that picking Yahoo as your search provider and searching sends your entire settings profile, including your persistent user ID, to SquarePage's own server, then routes the query through an ad affiliate before reaching Yahoo.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You select Yahoo as your search provider and press Enter to run a search from the new tab page.

The extension did this

SquarePage POSTs your entire settings profile to its own server, then sends your query to an ad affiliate on the way to Yahoo.

The same POST fires every time, whether or not you have a weather city or widgets configured.

Captured request
POSThttps://squarestartpage.com/api/activity/search?p=y&ext=st&id=1788887262606-38099928700&v=&gc=null

204 No Content

Body
{  "hit": {    "showWidgetWeather": true,    "showWidgetTicTacToe": true,    "showWidgetNotes": true,    "gameStats": {      "ticTacToe": {        "wins": 3,        "losses": 5      }    },    "configSearchProvider": "yahoo",    "configWeatherLocation": "Seattle",    "settings": {      "userId": "1788887262606-38099928700",      "tabs": 14,      "ref": {        "gclid": null,        "source_landing_page": "newtab",        "source_channel": "organic",        "created": "2026-03-15T09:22:00Z",        "days": 18      }    }  }}
What rides along with a Yahoo search
  • Persistent user ID
    1788887262606-38099928700

    Ties this and every future search back to the same profile, independent of cookies.

  • Weather city
    Seattle

    The city you set for the weather widget, unrelated to the search you just typed.

  • Install referral data
    source_channel: organic, source_landing_page: newtab

    The ad channel and landing page that first brought you to install SquarePage.

  • Open tab count
    14

    How many tabs you currently have open in the browser.

  • Widget settings and game stats
    ticTacToe: 3 wins, 5 losses

    Which widgets you've enabled and your Tic-Tac-Toe win/loss record.

The code that does this

The Yahoo branch posts the whole settings object, not just the search event

Readable version
if (settings.configSearchProvider === "yahoo") {  const url = "https://squarestartpage.com/api/activity/search"    + "?p=y&ext=st&id=" + settings.settings?.userId    + "&v=&gc=" + encodeURIComponent(settings.settings?.ref?.gclid);  // `hit` is the WHOLE settings object, not a search-event summary.  axios.post(url, { hit: settings });}
Where a Yahoo search goes
    • squarestartpage.com

    SquarePage's own backend. Receives the full settings profile on every Yahoo search.

    • search.pdf2docs.com

    Ad affiliate redirector. Carries your query and an affiliate code (RD1005233) before forwarding to Yahoo.

Observation

This only fires when Yahoo is the selected search provider; Google, Bing, DuckDuckGo, and Ecosia searches do not trigger either request. squarestartpage.com is SquarePage's own server, not an unrelated third party.

Search keystrokes are sent to finditnowonline.com for suggestions.

Typing in SquarePage's search box sends your partial text to suggest.finditnowonline.com for autocomplete, even with another search provider selected.

The request includes the typed text and an affiliate referral code.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user types into the extension's search box.

The extension did this

SquarePage requests autocomplete suggestions from suggest.finditnowonline.com using the current search text.

Captured request
GEThttps://suggest.finditnowonline.com/suggestionfeed/suggestion
Fields in the request
  • Search box text
    weather forecast (illustrative)

    Partial searches can reveal what the user is looking for before they submit a full query.

What it can do

Permissions this extension asks for, as declared in version 4.1.14. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Updated 30 September 2026hnjlcpngjhdoehbjfkmhjagmmojcimnc