Is Wanderlustar safe?

Medium risk

Wanderlustar sets itself as your default search engine and routes every search through wanderlustar.com with a fixed affiliate tag.

When installed, the extension overrides your default search provider so omnibox and default searches go to wanderlustar.com/k carrying your raw search terms plus a fixed monetization tag (source=7023.139). It also replaces your new-tab page, which loads an off-screen tracking iframe (wanderlustar.com/d.html) in the vendor's cookie context on every new tab, sending a recurring per-user beacon.

Wanderlustarv31324.911.57960Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Default Searches Routed Through Wanderlustar

Code analysis shows the extension sets Chrome's default search provider and new-tab form to send queries to wanderlustar.com/k, carrying your query in kw plus a fixed source value.

Dynamic analysis confirmed an install request to that host.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You enter a search in Chrome's default search UI or the Wanderlustar new-tab search form.

The extension has permission to replace Chrome's search provider and new-tab page.

The extension did this

The extension routes that search to wanderlustar.com/k with your query and a fixed source value.

The shipped manifest uses source=7023.139, and the new-tab form uses s=7023.139.

02EvidenceFIELD TABLE
Fields the shipped code places on routed searches
FieldValueWhy it matters
Your search terms
trail maps near denver (illustrative query)Sends the words you typed to the search endpoint.
Fixed source tag
7023.139Lets the endpoint group the request with this extension or campaign.
Search request URL
https://wanderlustar.com/k?source=7023.139&a=&fp=0.0&na=10&rc=10&kw=trail+maps+near+denver (illustrative query)Shows where the search is sent and how the query is attached.
Destination host
wanderlustar.comReceives the routed search instead of the search engine you previously used.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://wanderlustar.com/k?source=7023.139&a=&fp=0.0&na=10&rc=10&kw={searchTerms}
Configured top-level search navigation; no request body is defined.
04EvidenceCODE COMPARE
The code that does this

The manifest and new-tab code that route searches

What it actually does
Manifest default-search overridemanifest.json
{
"update_url": "https://clients2.google.com/service/update2/crx",
"action":{"default_icon":{"128":"icon128.png"}},"background":{"service_worker":"background.js","type":"module"},"chrome_settings_overrides":{"search_provider":{"encoding":"UTF-8","favicon_url":"https://wanderlustar.com/favicon","is_default":true,"keyword":"wanderlustar","name":"Wanderlustar","search_url":"https://wanderlustar.com/k?source=7023.139&a=&fp=0.0&na=10&rc=10&kw={searchTerms}"}},"chrome_url_overrides":{"newtab":"www/index.html"},"default_locale":"en","description":"Enable your inner Wanderlust, with every new tab discover amazing images and search the globe.","icons":{"128":"icon128.png"},"manifest_version":3,"name":"Wanderlustar","permissions":["search"],"version":"31324.911.57960"}
}
New-tab submit handlerwww/2.js

(function(onload){ if(document.readyState == 'complete')onload();else window.addEventListener("load",onload) })(function onload(){
 var c;try{c=chrome}catch(_){return};if(c.search==null||c.search.query==null)return;
 var fl=document.getElementsByTagName('input'),n=fl.length,i,e,f;
 for(i=0;i<n;++i)if((e=fl[i])&&e.type=='text')for(f=e.parentNode;f&&f!=document.body;f=f.parentNode)if((''+f.tagName).toUpperCase()=="FORM"&&!f._a)f_a=true,f.addEventListener('submit',mf(e));
 function mf(e){return function(){c.search.query({text:e.value})}}
})
05EvidenceTHIRD PARTY LIST
External host receiving routed searches
  • wanderlustar.com

    Receives the configured default-search and new-tab search requests, including the typed query and source tag.

Data recipients

wanderlustar.com
Updated 17 September 2026bgliakflmjnofiolfmnbncdmgfnibgnj