Is UpSearches safe?

Medium risk

UpSearches sends search-event telemetry with persistent identifiers to webinline-usage.streamesh.net.

UpSearches tracks first and second searches made through its configured UpSearches search provider. It sends the event type, generated extension and session identifiers, search counters and timestamps, install date, user agent, and extension version to webinline-usage.streamesh.net.

upsearchesv4.0.0Chrome Web Store
46Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

UpSearches tags every search with a persistent ID and reports it off-device

Every search through UpSearches's default search engine is tagged with a persistent device ID and sent to webinline-usage.streamesh.net.

We observed two live searches each produce a matching POST with that ID and a search count.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You search from the address bar using UpSearches, the extension's default search provider.

The query is sent to find.upsearches.com, which the extension set as your default search engine at install.

The extension did this

The service worker detects the search redirect and sends a report with your persistent device ID to webinline-usage.streamesh.net.

The report also includes a running count of how many searches you've made since installing.

Fields in the telemetry report
  • Device ID (EXT_UID)
    UN35396176904822237

    A random ID generated once when the extension installs, tying every report from your browser together.

  • Install ID (ISID)
    28a06467-81fc-7662-a21b-e5ffd60cc701

    A UUID generated at install time and sent with every report as a second persistent identifier.

  • Distribution ID (GID)
    rd1002519

    A fixed code identifying which distribution channel or partner installed the extension on your device.

  • Search count
    2

    How many searches you've made since installing, reported on your first and second search.

  • Browser and OS
    Chrome 128 / Windows 64Bit

    Your browser name, version, and operating system, sent with each report.

Captured request
POSThttps://webinline-usage.streamesh.net/

Observed during dynamic analysis: two searches through find.upsearches.com each produced this POST, with search_counter incrementing 1 then 2 and event_type first_search then second_search.

Headers
Content-Type
application/json
Body
{  "sessionid": "28a06467-81fc-7662-a21b-e5ffd60cc701",  "GID": "rd1002519",  "EXT_UID": "UN35396176904822237",  "event_type": "first_search",  "search_counter": 1,  "installeddate": "09-08-2026 22:58:41",  "channel": "",  "UTC_Time": "09-08-2026 23:01:03",  "event_time": 1757372463000,  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36",  "ext_version": "4.0.0"}
When this fires

Every 4 hours

Separately from search telemetry, the extension also phones home every 4 hours while your browser runs, confirming to the vendor that it's still installed and active.

Where your search activity and telemetry go
    • webinline-usage.streamesh.net

    Receives the persistent-ID telemetry report after your first and second searches.

    • find.upsearches.com

    The default search redirect endpoint; the extension also appends your stored identifiers to this request as URL query parameters.

    • i.upsearches.com

    Receives a periodic heartbeat report roughly every 4 hours confirming the extension is still installed.

What it can do

Permissions this extension asks for, as declared in version 4.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on upsearches.com

    https://*.upsearches.com/*

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

  • Watch every request your browser makes

    webRequest

Where it sends data

Destinations our analysis observed UpSearches contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • webinline-usage.streamesh.net

    UpSearches sends data to webinline-usage.streamesh.net. 9 other extensions we have analysed send data here.

Updated 21 September 2026ccncieedlifdlmckgmlcdfjehofcgoei