Is Vivid Sparkles safe?

Medium risk

Vivid Sparkles sends new-tab search queries with persistent install identifiers to search.vividsparkles.net.

Vivid Sparkles creates and stores per-install identifiers, then places them into hidden fields on its new-tab search page. When a user submits a search, the query and those identifiers are sent together to the extension's search service.

taylorkelley732v1.0.2Chrome Web Store
45Risk
Who publishes it

taylorkelley732 - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
taylorkelley732
Website
vividsparkles.net/index.html#contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Searches include query and persistent install identifiers.

When you submit a search from Vivid Sparkles, the extension sends your query with persistent per-install identifiers to search.vividsparkles.net.

The identifiers come from extension storage and link the search to your install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user submits a search from the new-tab search form.

The extension did this

The extension sends the search query together with persistent per-install identifiers.

Captured request
GETsearch.vividsparkles.net/feb358f6-2c68-4470-8543-6aa3b93dcb5a
Fields in the search request
  • Your search query
    weather tomorrow (illustrative)

    The words you typed into the new-tab search form are sent with the request.

  • Persistent installation identifiers
    d7f3a1b2-4c6d-4a90-9f24-1b2c3d4e5f60 (illustrative)

    Stored per-install values can link multiple searches back to the same extension installation.

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on vividsparkles.net

    *://vividsparkles.net/*

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Vivid Sparkles contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • search.vividsparkles.net

    Vivid Sparkles sends data to search.vividsparkles.net. No other extension we have analysed sends data here.

  • vividsparkles.net

    Vivid Sparkles sends data to vividsparkles.net. No other extension we have analysed sends data here.

Updated 30 September 2026fahgllkhagddijbjicnckgnohmdhhpbn