Quick Engine Switch

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

Quick Engine Switch exhibits browser hijacking behavior through its custom search endpoint configuration. The extension routes search queries through quickengineswitch.com/ext/search?src=default&q= as detected in finding "XIOC-URL-https://quickengineswitch.com/ext/search?src=default\u0026q=". This pattern matches known browser hijacking indicators where extensions intercept user search traffic to monetize through their own search infrastructure rather than using the browser's default search engine. The finding "XIOC-DOMAIN-quickengineswitch.com" confirms the extension's primary domain is used for search redirection.

The extension's developer identity is opaque - only an email address ([email protected]) is provided with no verified company name or organization. Combined with zero user count and version 0.1, this suggests a newly published extension with no established reputation. The wildcard permission "XIOC-URL-https://quickengineswitch.com/*" indicates broad access to the extension's own infrastructure.

Suspicious Domain Analysis: The IoC finding "XIOC-DOMAIN-1.ar" warrants investigation. While this could be a false positive from the IoC extractor, it represents an unexplained domain that doesn't correspond to the extension's stated functionality or known benign services. This domain should be investigated to determine if it represents additional monetization infrastructure or tracking.

False Positive Considerations: Several findings are clearly benign: date.now and button.id (finding titles "XIOC-DOMAIN-date.now" and "XIOC-DOMAIN-button.id") are JavaScript property access chains misidentified as domains by the XIOC extractor. Google infrastructure domains (fonts.googleapis.com, clients2.google.com, www.google.com) are standard for Chrome extensions. The seven code-smell findings are classified as severity=low and represent noise per CVEQ guidelines - they do not indicate malicious intent.

Counterargument: A skeptic might argue this is a legitimate search engine switcher extension, and custom search endpoints are necessary for such functionality. Many legitimate extensions have their own search infrastructure. However, the combination of anonymous developer, zero user count, unexplained 1.ar domain, and the specific search endpoint pattern (?src=default&q= which suggests query tracking) elevates this beyond normal extension behavior. Legitimate search switchers typically use established search providers rather than proprietary endpoints.

Recommendation: This extension should be classified as confirmed_risk with browser_hijack threat category. While not confirmed malware, the hijacking behavior and lack of developer transparency present measurable risk to users. The extension should be monitored for additional findings or user reports.

Key Reasons

• Custom search endpoint at quickengineswitch.com/ext/search with query tracking parameters
• Anonymous developer (email only, no verified company name)
• Unexplained 1.ar domain in IoC findings
• Zero user count suggests new/untested extension
• Browser hijacking pattern (custom search engine redirecting queries)

False Positive Considerations

• date.now and button.id are JavaScript property access chains misidentified as domains
• Google infrastructure domains (fonts.googleapis.com, clients2.google.com, www.google.com) are benign
• Code-smell findings (7 total, severity=low) are noise per CVEQ guidelines
• IoC volume inflated by legitimate extension infrastructure

Reviewed 2026-04-27; recommended action: monitor; model confidence 75%.