Is USPS Tracking safe?

High risk

USPS Tracking replaces the browser's default search engine with trackingnumbers.org, routing all omnibox searches and partial keystrokes to a third-party operator.

On install, the extension sets trackingnumbers.org as the default search engine via a manifest override, without any additional user confirmation. Every search query typed into the browser's address bar is sent to trackingnumbers.org. Chrome's suggest feature also transmits each partial keystroke to the operator's autosuggest endpoint in real time, before the user finishes typing or submits a query.

USPS Trackingv1.0.0.0Chrome Web Store
72Risk
Who publishes it

USPS Tracking - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
USPS Tracking

Same store account

2 other listings published from this account, 70k+ users between them. 2 of them carry a finding.

UPS Tracking40k+HighFedEx Tracking30k+High

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search Engine Replaced with Third-Party Operator on Install

Installing this extension sets trackingnumbers.org as your default search engine without a consent prompt.

Every search routes through it before reaching Yahoo.

It also fires install and pixel-tracking beacons to the operator.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You install this extension and type any search in your browser's address bar.

The extension did this

Your search query is sent to trackingnumbers.org before results appear, the extension replaced your default search engine on install.

No opt-in prompt is shown. The manifest.json sets trackingnumbers.org as the default search provider automatically on install.

Captured request
GEThttps://trackingnumbers.org/admin/public/link?q={searchTerms}

HTTP redirect to uk.search.yahoo.com/yhs/search?hsimp=yhs-mm_uspstracking&p=<planted marker value>, operator proxies the query to Yahoo Search, retaining the search term in its own server logs before forwarding.

What the operator receives on every search
  • Your search query
    USPS tracking 9400111899223397623910

    The exact text you typed in the address bar, before Yahoo Search receives it.

  • Yahoo affiliate code
    hsimp=yhs-mm_uspstracking

    A partner ID (yhs-mm_uspstracking) embedded in every forwarded search, attributing ad revenue to the operator.

The code that does this

Manifest setting that replaces your default search engine:

Readable version

manifest.json — chrome_settings_overrides

manifest.json
"chrome_settings_overrides": {  "search_provider": {    "name": "Online",    "keyword": "USPSTracking",    "search_url": "https://trackingnumbers.org/admin/public/link?q={searchTerms}",    "suggest_url": "https://trackingnumbers.org/admin/public/autosuggest?searchTerm={searchTerms}",    "favicon_url": "https://trackingnumbers.org/admin/public/favicon.ico",    "encoding": "UTF-8",    "is_default": true  }}

src/js/background.js — install beacons

src/js/background.js
const logInstallation = async () => {    await fetch(`https://${DOMAIN}/admin/public/install`, { mode: 'no-cors' });    await fetch(`https://${DOMAIN}/admin/public/pixels`, { mode: 'no-cors' });};chrome.runtime.onInstalled.addListener(async ({ reason }) => {    if (reason === 'install') {        await logInstallation();        await launchSuccessPage();    } else if (reason === 'update') {        await logInstallation();    }});
Endpoints that receive data from this extension
    • trackingnumbers.org

    Operator's server. Receives every address-bar search query, plus install and pixel-tracking beacons on install/update. Proxies results to Yahoo via affiliate link.

    • uk.search.yahoo.com

    Yahoo Search. Receives forwarded queries with affiliate code hsimp=yhs-mm_uspstracking, linking each search to the operator's Yahoo partner account.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on trackingnumbers.org

    *://trackingnumbers.org/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed USPS Tracking contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • trackingnumbers.org

    USPS Tracking sends data to trackingnumbers.org. One other extension we have analysed sends data here.

Updated 30 September 2026njincahdjloohmjeonojgjeihkgbjfko