Is The MBXtension safe?

Medium risk

The MBXtension sends the URL of each non-LinkedIn page you finish loading to mymosttrusted.net.

When a tab finishes loading on a site other than LinkedIn, the background script POSTs the page URL to mymosttrusted.net along with your profile id and partnership id. The URL is only populated for sites covered by the extension's host permissions, such as Microsoft, Zoom, Google Meet and its own domains. This send is not controlled by the extension's hide-on-LinkedIn setting.

My Most Trusted Networkv1.0.0.8Chrome Web Store
49Risk
Who publishes it

My Most Trusted Network - 16 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
My Most Trusted Network

Same store account

16 other listings published from this account, 2k+ users between them. 2 of them carry a finding.

The Bx xtension544LowSelling on the Spot Marketplace Global Nexus391LowCIBN Connect331LowCircle of Trust230LowLeadHERship Global204LowGHL Connect124Low10 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends the address of pages you finish loading to mymosttrusted.net

Code analysis shows the extension posts the URL of each completed non-LinkedIn page load to mymosttrusted.net, with your profile id in a request header.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page that is not on linkedin.com and it finishes loading.

The extension did this

The extension posts that page's address to mymosttrusted.net, tied to your profile id.

The code that does this

The navigation listener and the outbound call

Readable version

Listener branch that posts the URL

background.js
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  if (changeInfo.status === 'complete' && tab?.url) {    const { hideinli } = await chrome.storage.local.get(['csrf','csrf_update','hideinli']);    // comma expression: the sendMessage runs only when hideinli is falsy,    // but the URL check after the comma is evaluated regardless of hideinli    hideinli || chrome.tabs.sendMessage(tabId, { script: 'MMTWLMBXTENSIONContentLoader', method: 'initiate', args: ['callback'] });    if (tab.url && tab.url.search(/linkedin.com/) === -1) {      self.callBackEnd('-v5/detect-link', 'POST', { url: tab.url }, () => {}, true);    }  }});

Request builder

background.js
// POST body gains v, app, profile_id, partnership_id// header trustee = profile id from chrome.storage.syncfetch('https://mymosttrusted.net/api' + '-v5/detect-link', {  method: 'POST',  headers: { Accept: 'application/json', 'Content-Type': 'application/json', trustee: profileId },  body: JSON.stringify({ url, v, app, profile_id, partnership_id })});
What the request carries
  • Page address
    https://www.example.com/account/orders?id=1042

    The full URL of the page you just finished loading.

  • Profile id
    trustee: 5f3a91c2e8

    Your account id with the service, sent in the body and a header.

  • Extension version
    1.0.0.8

    Which build of the extension sent the request.

  • Extension name
    MyMostTrusted

    The extension's manifest name.

Where the data goes
    • mymosttrusted.net

    Receives the URL and profile id at /api-v5/detect-link; the vendor's own backend.

Scope caveat

This is code analysis only; no network capture was made. The manifest lists no tabs permission, so whether tab.url is populated for a given site depends on the host permissions granted.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed The MBXtension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mymosttrusted.netwidely used

    The MBXtension sends data to mymosttrusted.net. A widely used service: 39 other extensions we have analysed send data here.

Updated 15 October 2026dcibfpmgfmconkcbnfpmlbpgdjakcpdk