Is Best URL Shortener safe?

Medium risk

URL Shortener is medium risk. The extension fetches message config from a remote endpoint and uses the response to decide whether to show browser alerts, native notifications, or in-page notices, controlling text, notification type, timing, repetition, and targeting.…

Wilsonv2.0.2Chrome Web Store
49Risk
Who publishes it

DS Net - 7 other listings from the same operator, 4 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Wilson
Declared legal entity
DS Net
Registered address
620 Park View Dr, Santa Clara, CA 95054, United States
Website
tiny.cc/appshelp

Same operator - 7 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

QR Code Reader
same registered address
200k+Medium
EXIF Viewer Classic
same registered address
80k+Medium
EXIF Viewer Pro
same registered address
70k+Medium
Offline QR Code Generator
same registered address
10k+Medium
The QR Extension
same registered address
10k+Medium
Tiny URL Shortener
same registered address
9k+Low1 more listing in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote message config can trigger alerts and in-page notifications.

The extension fetches message config from a remote endpoint and uses the response to decide whether to show browser alerts, native notifications, or in-page notices, controlling text, notification type, timing, repetition, and targeting.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The extension reaches a remote_config_dependent check while in use.

The extension did this

It fetches remote notification/message config and may display alerts or in-page notifications based on the server response.

Captured request
GEThttps://dsnetx.web.app/apps/firelinks/msg.json
Fields in the request
  • Extension storage data
    app_id=best-url-shortener (illustrative)

    Stored extension context can be included when checking whether a remote message or notification should be shown.

Observation

Dynamic analysis confirmed a request to the remote message configuration endpoint, and the stored verification notes confirm that the fetched code path can show browser alerts or WebUI notifications based on the response.

Full URLs sent to undisclosed URL-shortener endpoints

Shortening a page sends the full long URL to hybridapps.net and amazonspot.net before falling back to tinyurl.com.

The store listing describes URL shortening generally; DB evidence names these third-party endpoints and the URL parameter.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You take an action to shorten a URL.

The extension did this

The extension sends the full long URL to additional third-party URL-shortener endpoints before falling back to tinyurl.com.

Captured request
GEThybridapps.net/apps/URLShortner/bitly.php
Fields in the request
  • Full page URL
    https://example.com/articles/page?ref=newsletter (illustrative)

    Identifies the page you chose to shorten and can include query strings or other page-specific context.

What it can do

Permissions this extension asks for, as declared in version 2.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026jhcjblhckchiedihkfkgjaghggbcmbdn