News Searcher Pro

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

News Searcher Pro is a search and news add-on published under the Gmail address [email protected], at version 0.0.2, with nine users. The listing declares no permissions and no host permissions. That is worth stating plainly because it does not match what the code does: util.js opens outbound requests at lines 68, 90 and 329, logged as NET-FETCH-util.js-68, NET-FETCH-util.js-90 and NET-FETCH-util.js-329. A search helper that fetches from a backend is ordinary. Where it fetches from is the problem.

The host list splits into three groups. There is the extension's own service: newsearcherpro.com, www.newsearcherpro.com and suggest.newsearcherpro.com. A suggest subdomain takes what the user types. Then there is third-party infrastructure: webinline-usage.streamesh.net records usage, and obsrchrdr.com, with its ext. subdomain, decomposes as a search redirector with ext naming the extension as the traffic source. Then there is cookiedata.gd, registered under Grenada's TLD, whose name describes exactly what it sounds like.

The most revealing string is sns-q-search-extensions-service-us-east-1-k8s-internal.seccint.com. That is an internal Kubernetes service name, shipped to browsers by mistake. It advertises a multi-tenant search extensions service, a backend built to serve this extension and others of the same shape. Two hosts, nė.az and ԥ.uy, use single non-ASCII labels under Azerbaijan and Uruguay. Those could be domain rotation or extractor artifacts from minified strings, and this data cannot settle which.

What does not hold up: eighteen IoC entries and eight code-smell findings. There are zero malware signatures, zero obfuscation findings and zero tool-poisoning hits. The IoC list is the usual mix of domain-shaped substrings lifted from minified JavaScript. The code-smell rules fire on ordinary scripts. The endpoint names are what matter here, and they name redirector and tracking infrastructure rather than a news API.

A skeptic would say this is a white-label search API, that extensions call search backends, and that empty permission arrays mean the code cannot do much harm. Two details argue against that. The hosts span five unrelated TLDs and four naming schemes, which fits a monetization chain assembled from rotating providers rather than one vendor's API. And the leaked internal hostname shows a backend built specifically for search extensions, not a news service. What remains unknown is whether the extension rewrites the omnibox or new tab page, which is why this lands as a risk rather than a confirmed hijack.

Key Reasons

• util.js makes three outbound fetch calls (NET-FETCH-util.js-68, NET-FETCH-util.js-90, NET-FETCH-util.js-329) while the listing declares no permissions and no host permissions
• Third-party hosts include ext.obsrchrdr.com (a search redirector), cookiedata.gd and webinline-usage.streamesh.net, none of which belong to the extension's own newsearcherpro.com service
• Shipped code contains the internal Kubernetes hostname sns-q-search-extensions-service-us-east-1-k8s-internal.seccint.com, showing a multi-tenant search-extension backend
• Publisher identity is a Gmail address with no company attribution, at version 0.0.2 with nine users
• No malware signatures, obfuscation or tool-poisoning findings, so the 18 IoC and 8 code-smell entries carry no weight

False Positive Considerations

• 18 IoC entries dominated by domain-shaped strings pulled from minified JavaScript
• 8 code-smell findings that fire on ordinary JavaScript
• 3 network findings are plain fetch calls inside a bundled util.js
• Non-ASCII hostnames nė.az and ԥ.uy look like extraction artifacts from minified unicode strings

Reviewed 2026-10-02; recommended action: monitor; model confidence 70%.