Is USA Coupons, Deals, Promo Codes Search safe?

Medium risk

USA Coupons, Deals, Promo Codes Search replaces your default search engine with chromecrxstore.com.

The extension's manifest sets a search provider named 'Internet' as the browser default. Address-bar searches and each keystroke suggestion are sent to chromecrxstore.com. The context menu and popup also open chromecrxstore.com search pages.

AdBhuT Extensionsv1.1Chrome Web Store
49Risk
Who publishes it

AdBhuT Extensions - 5 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AdBhuT Extensions

Same store account

5 other listings published from this account, 127 users between them. 3 of them carry a finding.

Price Comparison – Amazon vs. Walmart, Target, Best Buy, eBay & more61CleanAcademic Search Navigator35MediumRight Click to Search Any Site: Youtube, Reddit, Wikipedia, Twitter & More14MediumRecipe Finder with Ingredients: Cook With What You Have9MediumRealSearch - Human Answers Only (No AI Spam)8Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Coupon search extension sets chromecrxstore.com as your default search engine

Code analysis shows the manifest sets chromecrxstore.com as the default search provider, so address-bar searches and suggestions go to that host.

The coupon features do not need this.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You type a search into the browser address bar.

The extension did this

The query is sent to chromecrxstore.com instead of your previous search engine.

Suggestions are requested from the same host as you type.

The code that does this

Search provider override in manifest.json

Readable version

Coupon search URL used by the context menu in background.js

background.js
const targetUrl = `https://chromecrxstore.com/ex/uscouponsearch/?q=${encodeURIComponent(finalQuery)}`;
Values the provider receives
  • Search query
    https://chromecrxstore.com/query/index.html?q=best+flights+to+denver

    Whatever you type in the address bar and submit.

  • Partial query
    https://chromecrxstore.com/suggest.php?q=best+fli

    Text typed so far, requested for suggestions as you type.

Where searches go
    • chromecrxstore.com

    Receives search queries and suggestion requests; not the coupon service named in the listing.

Check if you're affected

Reads an extension manifest and reports any default search provider override.

Requires
  • Node.js 18+
check_search_override.js · js
const m = JSON.parse(require('fs').readFileSync(process.argv[2], 'utf8'));const sp = m.chrome_settings_overrides && m.chrome_settings_overrides.search_provider;if (sp) {  console.log('default:', sp.is_default, 'search:', sp.search_url, 'suggest:', sp.suggest_url);} else {  console.log('no search provider override');}
How to run it
  1. 1Unpack the CRX.
  2. 2Run node check_search_override.js path/to/manifest.json.
  3. 3Compare the hosts with the extension's stated purpose.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed USA Deal Finder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromecrxstore.com

    USA Deal Finder sends data to chromecrxstore.com. 13 other extensions we have analysed send data here.

Updated 15 October 2026pileljahoggbiobjjmiakkoagcbaceji