Is Unicorn Universe safe?

Medium risk

Unicorn Universe sends the full URL of every page you finish loading to mymosttrusted.net.

A background script runs on every completed tab load outside LinkedIn and posts the page URL to the extension's own backend. The request carries your profile ID from extension storage, so visited URLs are tied to your account. This happens in all tabs, not only on the sites the extension is designed to work on.

My Most Trusted Networkv1.0.0.3Chrome Web Store
49Risk
Who publishes it

My Most Trusted Network - 16 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
My Most Trusted Network

Same store account

16 other listings published from this account, 2k+ users between them. 2 of them carry a finding.

The Bx xtension544LowSelling on the Spot Marketplace Global Nexus391LowCIBN Connect331LowCircle of Trust230LowLeadHERship Global204LowGHL Connect124Low10 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension posts the URL of every non-LinkedIn page you load to mymosttrusted.net

Code analysis shows the background script posts each completed tab's full URL, with your profile id, to mymosttrusted.net/api-v5/detect-link on every site except LinkedIn.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You finish loading any web page in a tab, on any site other than LinkedIn.

The extension did this

The extension sends that page's full URL, tied to your profile id, to mymosttrusted.net.

The call is not limited to the sites the extension's content scripts target.

The code that does this

The listener branch and the request helper that carry the URL out:

Readable version

Navigation listener branch

background.js
if ("complete" == a.status && (... t?.url && -1 == t?.url?.search(/linkedin.com/gm))) {  var { url: c } = t;  self.callBackEnd("-v5/detect-link", "POST", { url: c }, (e => {}), !0)}

Request helper

background.js
t.v = chrome.runtime.getManifest().version, t.app = chrome.runtime.getManifest().name, t.profile_id = c;const l = { method: a, headers: { Accept: n || "application/json", "Content-Type": "application/json", trustee: c || t.profile_id || "" } };l.body = JSON.stringify(t);fetch("https://mymosttrusted.net/api" + e, l)
Fields in the detect-link request, as built by the code
  • Page URL
    https://www.example-bank.com/accounts/overview?tab=1 (illustrative)

    The full address of the tab that just finished loading, including path and query.

  • Profile id
    a1b2c3d4 (illustrative)

    The extension's profile id from synced storage, sent in the body and a trustee header.

  • Version and app name
    1.0.0.3

    Extension version and name from the manifest.

  • Partnership id
    partner-17 (illustrative)

    Added when an active partnership is stored in the extension.

Where the URL is sent
    • mymosttrusted.net

    The extension's own backend; receives page URL plus profile id at /api-v5/detect-link.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Unicorn Universe contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mymosttrusted.netwidely used

    Unicorn Universe sends data to mymosttrusted.net. A widely used service: 39 other extensions we have analysed send data here.

Updated 15 October 2026llpijkilkdhpioiibpeecddnfdlojcnj