Is Top Green Search safe?

Medium risk

Top Green Search appends a persistent session ID to searches sent to topgreenview.com.

The extension makes topgreenview.com the browser's default omnibox search provider and creates a random 32-character session ID stored locally. When omnibox searches navigate to topgreenview.com/search, it rewrites the request URL to include that persistent session value.

wtucker867v1.0.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Top Green Search injects a permanent tracking ID into every search you make

As your default search provider, Top Green Search adds a persistent 32-character ID to every search you run.

We observed the ID appended to the search request and confirmed it stays the same across searches and restarts.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You search using Top Green Search, set as the browser's default search provider.

The same thing happens if you navigate straight to a topgreenview.com/search URL.

The extension did this

A background rule rewrites the request to add a permanent session ID before it reaches topgreenview.com.

The same ID is reused for every search until browser storage for the extension is cleared.

Captured request
GEThttps://topgreenview.com/search?q=test&session=hfwzy1ih3hw88809rvrh2vptu6y3nz2o

302 redirect chain observed during dynamic analysis: the original request (https://topgreenview.com/search?q=test, no session parameter) was rewritten by the extension's declarativeNetRequest rule to this URL before leaving the browser.

What topgreenview.com receives on every search
  • Persistent session ID
    hfwzy1ih3hw88809rvrh2vptu6y3nz2o

    A random 32-character ID that stays the same across restarts, letting the site tie every search back to this one browser install.

  • Search term
    best noise cancelling headphones

    Whatever you typed into the omnibox, sent to the search engine as part of running the search itself.

The code that does this

The session-tagging logic in bg.js

Readable version
// Read (or create) a per-install session IDchrome.storage.local.get(["session"], settings => {    let sessionId;    if (settings.session) {        // Reuse the same ID on every subsequent startup        sessionId = settings.session;    } else {        // First run: generate a random 32-character ID        sessionId = [...Array(32)].map(() => (~~(Math.random() * 36)).toString(36)).join("");        chrome.storage.local.set({session: sessionId}, () => {            // Report the new ID to the vendor once, on install            fetch(`https://topgreenview.com/start?session=${sessionId}`, {mode: "no-cors"}).then();        });    }    // The same ID is also handed back on uninstall    chrome.runtime.setUninstallURL(`https://topgreenview.com/uninstall?session=${sessionId}`);    // Install a network rule that tags every search with this ID    chrome.declarativeNetRequest.getDynamicRules(rules => {        chrome.declarativeNetRequest.updateDynamicRules({removeRuleIds: rules.map(r => r.id)}, () => {            chrome.declarativeNetRequest.updateDynamicRules({                addRules: [{                    id: 10,                    action: {                        type: "redirect",                        redirect: {                            // Appends ?session=<sessionId> to the outgoing request                            transform: {queryTransform: {addOrReplaceParams: [{key: "session", value: sessionId}]}}                        }                    },                    // Applies to every top-level navigation to topgreenview.com/search                    condition: {urlFilter: "topgreenview.com/search", resourceTypes: ["main_frame"]}                }]            }).then();        });    });});
Where the session ID goes
    • topgreenview.com

    The extension's default search provider. Receives the session ID on the install beacon (/start), every search (/search), and uninstall (/uninstall).

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on topgreenview.com

    *://topgreenview.com/*

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed Top Green Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • topgreenview.com

    Top Green Search sends data to topgreenview.com. No other extension we have analysed sends data here.

Updated 30 September 2026fohciagejckehfgeoipcilnpmnnakkpj