Is Wanderlustar safe?
Wanderlustar sets itself as your default search engine and routes every search through wanderlustar.com with a fixed affiliate tag.
When installed, the extension overrides your default search provider so omnibox and default searches go to wanderlustar.com/k carrying your raw search terms plus a fixed monetization tag (source=7023.139). It also replaces your new-tab page, which loads an off-screen tracking iframe (wanderlustar.com/d.html) in the vendor's cookie context on every new tab, sending a recurring per-user beacon.
Who publishes itSolex Ltd - 1 other listing from the same operator, none carrying a finding
Solex Ltd - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 1 listing
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Default Searches Routed Through Wanderlustar
Code analysis shows the extension sets Chrome's default search provider and new-tab form to send queries to wanderlustar.com/k, carrying your query in kw plus a fixed source value.
Dynamic analysis confirmed an install request to that host.
What actually happens
You enter a search in Chrome's default search UI or the Wanderlustar new-tab search form.
The extension has permission to replace Chrome's search provider and new-tab page.
The extension routes that search to wanderlustar.com/k with your query and a fixed source value.
The shipped manifest uses source=7023.139, and the new-tab form uses s=7023.139.
Fields the shipped code places on routed searches
- Your search termstrail maps near denver (illustrative query)
Sends the words you typed to the search endpoint.
- Fixed source tag7023.139
Lets the endpoint group the request with this extension or campaign.
- Search request URLhttps://wanderlustar.com/k?source=7023.139&a=&fp=0.0&na=10&rc=10&kw=trail+maps+near+denver (illustrative query)
Shows where the search is sent and how the query is attached.
- Destination hostwanderlustar.com
Receives the routed search instead of the search engine you previously used.
Captured request
Configured top-level search navigation; no request body is defined.
The code that does this
The manifest and new-tab code that route searches
Manifest default-search override
manifest.json{ "update_url": "https://clients2.google.com/service/update2/crx", "action":{"default_icon":{"128":"icon128.png"}},"background":{"service_worker":"background.js","type":"module"},"chrome_settings_overrides":{"search_provider":{"encoding":"UTF-8","favicon_url":"https://wanderlustar.com/favicon","is_default":true,"keyword":"wanderlustar","name":"Wanderlustar","search_url":"https://wanderlustar.com/k?source=7023.139&a=&fp=0.0&na=10&rc=10&kw={searchTerms}"}},"chrome_url_overrides":{"newtab":"www/index.html"},"default_locale":"en","description":"Enable your inner Wanderlust, with every new tab discover amazing images and search the globe.","icons":{"128":"icon128.png"},"manifest_version":3,"name":"Wanderlustar","permissions":["search"],"version":"31324.911.57960"}}New-tab submit handler
www/2.js(function(onload){ if(document.readyState == 'complete')onload();else window.addEventListener("load",onload) })(function onload(){ var c;try{c=chrome}catch(_){return};if(c.search==null||c.search.query==null)return; var fl=document.getElementsByTagName('input'),n=fl.length,i,e,f; for(i=0;i<n;++i)if((e=fl[i])&&e.type=='text')for(f=e.parentNode;f&&f!=document.body;f=f.parentNode)if((''+f.tagName).toUpperCase()=="FORM"&&!f._a)f_a=true,f.addEventListener('submit',mf(e)); function mf(e){return function(){c.search.query({text:e.value})}}})External host receiving routed searches
- wanderlustar.com
Receives the configured default-search and new-tab search requests, including the typed query and source tag.
What it can do
Permissions this extension asks for, as declared in version 31324.911.57960. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Run searches with your default search engine
search
Where it sends data
Destinations our analysis observed Wanderlustar contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- wanderlustar.com
Wanderlustar sends data to wanderlustar.com. One other extension we have analyzed sends data here.