Search Safe Security

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

Search Safe Security declares no permissions and no host permissions. Its leverage over the browser comes through search settings. Files inside the package carry the string overrides.search, the service searchtools.app with its /api/search and /api/suggest endpoints, and two legal pages, system1.com/terms/terms-of-use and system1.com/terms/privacy-policy. Read together, those strings describe a search distribution extension. A query typed into the address bar leaves for https://searchtools.app/api/search?q=, and System1, the outfit whose terms of use this extension links to, earns its money from search traffic deals. The extension's own description, "Enhanced search experience with Search Safe Security," does not name any of this.

The scanner's one non-IoC match, YARA--postinstall_crypto_operations, landed on /_metadata/verified_contents.json. Chrome Web Store writes that file to record its own signature over a package, so the rule tripped on platform metadata rather than on anything the extension executes. Had the rule hit install-time source, it would point to cryptographic work such as key generation or mining. No malware signature matched, no obfuscation finding appears, and the empty permission list leaves no declared route to cookies, tabs or injected page scripts. No manifest-analysis or network finding fired either, which follows from that empty permission set rather than from a clean inspection: there was little for those checks to hook into.

The eleven IoC rows mostly recycle a small set of addresses. XIOC-URL-https://searchtools.app/api/search, XIOC-URL-https://searchtools.app/api/suggest?q= and XIOC-URL-https://searchtools.app repeat the same host, one row garbles a minified string into https://searchtools.app/api/search';, and XIOC-DOMAIN-gmail.com plus [email protected] register the publisher's own contact address. XIOC-DOMAIN-overrides.search records a settings key rather than a network destination. The signal worth weighing is searchtools.app itself, the endpoint that receives every query, and the System1 pages that place the extension inside a commercial search network.

A skeptic could argue the extension does what its description promises: a search experience delivered through its own service, in version 1.0.2 of a Chrome listing. Search tools replace search engines by design. The objection fails on the details. System1 monetises search distribution at scale, and this extension routes a user's query stream into that network under a gmail-address publisher with eight users and no company attribution. The capability set stays narrow, which keeps this out of credential-theft or malware territory, but routing address-bar traffic to a third party for revenue matches the browser hijack pattern, and no scanner artifact produced it.

Key Reasons

• Search provider override to searchtools.app (/api/search, /api/suggest) with System1-hosted legal pages, matching the search hijack pattern
• No permissions, host permissions, malware signatures or obfuscation findings, so the package shows no credential or page-injection capability
• Only code-level match is YARA--postinstall_crypto_operations on /_metadata/verified_contents.json, Chrome's own signature metadata file
• Publisher identified only as [email protected], with 8 users and no company attribution

False Positive Considerations

• YARA--postinstall_crypto_operations matched /_metadata/verified_contents.json, a Chrome Web Store signature file, not extension code
• Repeated extraction of the same searchtools.app API URLs, plus a mangled variant (https://searchtools.app/api/search';) from minified JS, inflates the IoC count
• [email protected] and XIOC-DOMAIN-gmail.com record the publisher's own contact address, not leaked data
• XIOC-DOMAIN-overrides.search records a manifest settings key rather than a live network destination

Reviewed 2026-10-14; recommended action: monitor; model confidence 65%.