Quick Search Tool

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

Quick Search Tool (200,000 users) demonstrates clear browser hijacking behavior through custom search infrastructure. The extension routes user searches through search.quicksearchtool.com and query.quicksearchtool.com domains, as evidenced by IoC findings including XIOC-URL-https://query.quicksearchtool.com/s?query= and XIOC-URL-https://search.quicksearchtool.com/autosuggest?query=. These domains intercept search queries instead of using standard search engines like Google or Bing.

The extension declares the tabs permission in manifest.json, flagged by the MANIFEST-SENSITIVE-PERM-TABS finding. This permission enables the extension to read and modify browser tab content, which is necessary for intercepting address bar searches and redirecting them through the custom search infrastructure. Network activity in background.js:8 (detected by NET-FETCH-background.js-8) confirms the extension makes external requests, consistent with search redirection behavior.

Importantly, no malware signatures were detected in this extension. The findings_summary shows zero malware findings and zero obfuscation findings. There are no credential theft indicators, no proxyware functionality, and no code attempting to steal cookies or session tokens. The five code-smell findings present are classified as low-severity noise patterns that match common JavaScript constructs.

Several IoC findings represent known false positives. The XIOC-URL-https://clients2.google.com/service/update2/crx finding references Google's legitimate CRX update endpoint, which is standard for Chrome extensions. The XIOC-DOMAIN-chrome.runtime.id finding is an API reference, not an actual network domain. Generic patterns like https://log.$ and https://hp.$ are extraction artifacts without meaningful threat value.

Counterargument consideration: A skeptic might argue that 200,000 users suggests this extension is benign and widely trusted. However, user count alone does not validate extension safety. Browser hijackers often accumulate users through aggressive distribution tactics or unclear consent flows during installation. The custom search domain behavior is the defining characteristic here—regardless of user count, routing searches through quicksearchtool.com domains constitutes browser hijacking. This is a Potentially Unwanted Program (PUP) pattern that modifies user search behavior without transparent consent, even if it doesn't deliver malware or steal credentials. Users should be aware their searches are being processed through an unknown third-party service rather than their preferred search engine.

Key Reasons

• Custom search domains (search.quicksearchtool.com, query.quicksearchtool.com) intercept user queries
• tabs permission enables search interception and redirection
• Zero malware signatures detected
• No obfuscation or credential theft indicators present
• Browser hijacking PUP behavior confirmed through IoC analysis

False Positive Considerations

• Google CRX update endpoint (clients2.google.com)
• chrome.runtime.id API reference misclassified as domain
• Generic patterns (log.$, hp.$) extraction artifacts
• Low-severity code-smell findings

Reviewed 2026-05-23; recommended action: monitor; model confidence 85%.