Is Trending News & Search safe?

Medium risk

Trending News & Search redirects user searches to Yahoo using hardcoded affiliate tracking codes with no disclosure to users.

When a user submits a search, the extension constructs a Yahoo Search URL containing hardcoded affiliate codes (hspart=ata, hsimp=yhs-001) and navigates the browser to it. The extension's UI presents only a generic 'Search the web' prompt with no indication that searches are monetized through an undisclosed affiliate arrangement. User search queries are transmitted to search.yahoo.com alongside the affiliate tracking parameters.

Trending News & Searchv1.0.2Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Search box sends queries to a Yahoo affiliate URL

When you search, the extension builds a Yahoo URL with your terms plus fixed tracking parameters.

The box reads only "Search the web" while using hspart=ata, hsimp=yhs-001, type=9024444-aal-180001-180002, param1=180001, param2=180002.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You submit a search in the extension's search box.

The visible placeholder says "Search the web".

The extension did this

The extension sends the browser to Yahoo Search with your query and fixed partner tracking values.

The redirect is assigned directly to the page location after the form is submitted.

02EvidenceFIELD TABLE
Fields placed into the Yahoo Search URL
FieldValueWhy it matters
Your search terms
weatherThe words you typed are sent as the search query.
Yahoo search endpoint
https://search.yahoo.com/yhs/searchYour browser is sent to Yahoo Search instead of staying inside the extension.
Partner source
hspart=ataThis fixed value marks the request as coming through a partner search integration.
Partner implementation
hsimp=yhs-001This fixed value adds another partner tag to the same search request.
Campaign type
type=9024444-aal-180001-180002This fixed value can group the request with a specific traffic source or campaign.
Additional partner IDs
param1=180001&param2=180002These fixed values add more attribution context to the same search request.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://search.yahoo.com/yhs/search?hspart=ata&hsimp=yhs-001&grd=1&type=9024444-aal-180001-180002&param1=180001&param2=180002&p=weather
04EvidenceCODE COMPARE
The code that does this

The form submit handler that builds the Yahoo redirect

What it actually does
Readable version of the same submit handlerassets/index-6fa193f8.js
function Uu() {
  const e = U.useRef(null),
    t = n => {
      var i;
      n.preventDefault();
      const r = (i = e.current) == null ? void 0 : i.value.trim();
      if (r) {
        const o = `https://search.yahoo.com/yhs/search?hspart=ata&hsimp=yhs-001&grd=1&type=9024444-aal-180001-180002&param1=180001&param2=180002&p=${encodeURIComponent(r)}`;
        window.location.href = o, e.current && (e.current.value = "")
      }
    };
  return w.jsx("div", {
    className: "search-wrapper",
    children: w.jsx("div", {
      className: "search",
      children: w.jsx("form", {
        id: "yahooSearch",
        onSubmit: n => t(n),
        children: w.jsx("input", {
          id: "yahooSearchQuery",
          ref: e,
          type: "text",
          placeholder: "Search the web",
          autoComplete: "off"
        })
      })
    })
  })
}
05EvidenceTHIRD PARTY LIST
Destination named by the redirect code
  • search.yahoo.com

    Receives the submitted search query through Yahoo Search with fixed partner attribution parameters.

Data recipients

search.yahoo.com
Updated 17 September 2026amo-2828256