Is The Operators Trusted Network safe?

Medium risk

The Operators Trusted Network sends the URL of each page you finish loading on its permitted sites to its own server.

After a tab finishes loading, the extension posts that tab's URL, along with your profile ID, to mymosttrusted.net, unless the page is on LinkedIn. Because it has no tabs permission, URLs are only visible for the video-meeting and vendor hosts it is allowed to run on, such as Google Meet, Zoom and Microsoft sites.

MMT Networkv1.0.0.8Chrome Web Store
49Risk
Who publishes it

MMT Network - 18 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
MMT Network

Same store account

18 other listings published from this account, 918 users between them. 1 of them carries a finding.

Grand Connection Networking234LowBNI Philippines147LowBridge Collective91LowEngagePro85LowMaltix Connect65LowCIRA45Low12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension posts each loaded meeting-site tab URL to mymosttrusted.net

Code analysis shows the service worker sends each completed tab's URL, plus a profile ID, to mymosttrusted.net/api-v5/detect-link.

Tab URLs are readable only on the sites in host_permissions.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page on a meeting site such as Google Meet or Zoom and it finishes loading.

No click or consent step is involved.

The extension did this

The extension posts that page's address and your profile ID to mymosttrusted.net.

Addresses containing linkedin.com are skipped.

Fields in the detect-link request
  • Page address
    https://meet.google.com/abc-defg-hij

    The full URL of the tab that just finished loading.

  • Profile ID
    profile_id from chrome.storage.sync (value not captured)

    The ID from your extension profile, sent in the body and in a header.

  • Extension version
    1.0.0.8

    The installed extension version.

  • Extension name
    The Operators Trusted Network

    The name from the manifest.

  • Partnership ID
    partnership_id from chrome.storage.local (value not captured)

    Added when an active partnership is stored locally.

The code that does this

Listener and request builder

Readable version

Readable listener (abridged)

background.js
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  if (changeInfo.status == "complete" && tab?.url) {    // ... LinkedIn cookie/CSRF refresh omitted ...    if (tab?.url && tab.url.search(/linkedin.com/gm) == -1) {      var { url } = tab;      self.callBackEnd("-v5/detect-link", "POST", { url }, (res) => {}, true);    }  }});

Readable request builder (abridged)

background.js
self.callBackEnd = async function (path, method, body, cb, ..., ) {  body = body || {};  self.profile((profileId) => {    // non-GET: body gets version, extension name and profile id    body.v = chrome.runtime.getManifest().version;    body.app = chrome.runtime.getManifest().name;    if (!body.profile_id) body.profile_id = profileId;    const opts = {      method,      headers: { Accept: "application/json", "Content-Type": "application/json", trustee: profileId || body.profile_id || "" },      body: JSON.stringify(body)    };    fetch("https://mymosttrusted.net/api" + path, opts);  });};
Where the page address goes
    • mymosttrusted.net

    Receives POST /api-v5/detect-link with the page URL and profile ID; also the extension's vendor backend.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed The Operators Trusted Network contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mymosttrusted.netwidely used

    The Operators Trusted Network sends data to mymosttrusted.net. A widely used service: 39 other extensions we have analysed send data here.

Updated 15 October 2026eckbneglpbjdlaehnlpcmgjofkingcje