Explore My Fitness

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

Browser Hijacking Evidence

The extension "Explore My Fitness" demonstrates clear browser hijacking behavior through the presence of owsrchrdr.com in multiple IoC findings. This domain appears in findings titled XIOC-URL-https://*.owsrchrdr.com/* and XIOC-URL-https://owsrchrdr.com?dgd=RD1005574&PCSF=true&q=. The domain owsrchrdr.com is a known search redirect domain used by browser hijackers to intercept user search queries and redirect them through monetized search engines. The URL parameters dgd=RD1005574&PCSF=true are tracking identifiers commonly used to attribute traffic to specific hijacker campaigns.

Search Suggestion Infrastructure

The extension also contains a suggestion endpoint at https://suggest.exploremyfitness.com/suggestionfeed/suggestion?format=JSON&q= (finding XIOC-URL-https://suggest.exploremyfitness.com/suggestionfeed/suggestion?format=JSON&q=). This endpoint structure is consistent with search query interception, where user input is captured and potentially forwarded to third-party services for monetization.

Network Activity

A network finding NET-FETCH-util.js-90 confirms fetch calls are made from util.js:90, indicating active network communication. Combined with the search redirect domain, this suggests the extension actively redirects searches.

Publisher Red Flags

The developer is listed as [email protected], a generic Gmail address rather than a company domain. The extension has only 4 users and version 0.0.2, indicating minimal adoption and early-stage deployment. These factors reduce accountability and increase risk.

Counterargument Addressed

A skeptic might argue that the extension's own domains (exploremyfitness.com, i.exploremyfitness.com) suggest legitimate functionality. However, the presence of owsrchrdr.com—a third-party search redirect domain with tracking parameters—is the critical indicator. Legitimate fitness extensions do not require search redirect infrastructure. The Google update service domain (clients2.google.com/service/update2/crx) is benign and expected in Chrome extensions, but it does not mitigate the hijacking behavior from owsrchrdr.com. The code-smell findings (10 total) are low-severity noise and do not change the verdict, but the search redirect domain is a specific, high-confidence threat indicator that cannot be dismissed as false positive.

Key Reasons

• Search redirect domain owsrchrdr.com with tracking parameters indicates browser hijacking
• Anonymous developer using Gmail address instead of company domain
• Search suggestion endpoint suggests query interception infrastructure
• Very low user count (4) and early version (0.0.2) indicate minimal oversight
• No malware signatures but clear PUP/hijacking behavior patterns

False Positive Considerations

• Google update service domain clients2.google.com is legitimate infrastructure
• Code-smell findings (10) are low-severity noise per CVEQ documentation

Reviewed 2026-04-30; recommended action: escalate; model confidence 85%.