DogDog - feed dogs with every search from your browser bar

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The DogDog extension exhibits clear browser hijacking behavior. The IoC finding XIOC-URL-https://www.dogdog.org/search?q= in extracted_from_files reveals a search engine URL template that intercepts and redirects user queries to www.dogdog.org instead of the user's configured search provider. This matches the extension's stated purpose of "feed dogs with every search" - a common monetization pattern where third-party search engines pay for query traffic.

The developer attribution "[email protected]" provides no identifiable company name, which is a red flag for extensions making significant changes to browser behavior. The IoC XIOC-DOMAIN-module.id in extracted_from_files is concerning: this is not a known benign infrastructure domain (unlike googleapis.com or cloudflare.com) and likely represents a tracking or analytics service with no clear relationship to the extension's stated purpose.

Several findings are false positives that inflate the finding count. The IoC XIOC-IP-1.2.2.0 is the extension version number misread as an IP address. The IoC XIOC-IP-b::d is an IPv6 fragment false positive from minified JavaScript. The 8 low-severity code-smell findings are noise per CVEQ guidelines and do not indicate malicious behavior. The Google update service URL clients2.google.com/service/update2/crx is a legitimate Chrome extension infrastructure endpoint.

Counterargument: A skeptic might argue this is a legitimate charity extension that donates search revenue to animal shelters. However, the combination of search hijacking behavior, generic developer email without company attribution, and the presence of the unexplained module.id domain indicates this is a monetization scheme rather than a transparent charity tool. Legitimate donation extensions typically partner with known organizations and disclose their revenue model. The search hijack pattern itself is the primary risk - users lose control over their search provider without clear consent, and the module.id domain suggests additional data collection beyond what is necessary for the stated functionality.

Key Reasons

• Search engine hijack pattern detected via dogdog.org/search?q= URL template
• Generic developer email ([email protected]) with no company attribution
• Suspicious tracking domain module.id in IoCs
• Extension category (search redirect) conflicts with benign charity claims
• Low user count (448) with no verified publisher status

False Positive Considerations

• Version number 1.2.2.0 misread as IP address
• IPv6 fragment b::d from minified JavaScript
• Code-smell findings (8 low-severity) are noise
• Google update service URL is legitimate infrastructure

Reviewed 2026-04-28; recommended action: monitor; model confidence 82%.