Better Search Hijacks Default Search and Redirects Queries to getbettersearch-api.com

Overview

Better Search is a Chrome extension with over 200,000 installs. The sandbox analysis of version 1.26.604 found that it forcibly sets the default search provider to https://search.getbettersearch-api.com/search/{searchTerms} and installs a declarativeNetRequest rule that rewrites every search request to https://search.getbettersearch-api.com/crx/search.php carrying a per-install GUID. This is a search-hijacking mechanism that redirects the user's entire search traffic to an operator-controlled endpoint.

How it works

On installation, the extension fetches remote configuration from https://api.getbettersearch-api.com/api/v2/json/install (see lib/ext.js:121 and :134). The request includes the extension ID, version, and partner/region identifiers. The remote config response (not captured in the sandbox) likely determines the exact search redirect URL and partner parameters.

The extension's own code sets the default search engine using the Chrome settings override API. The sandbox observed a dynamic event where search_provider was set to https://search.getbettersearch-api.com/search/{searchTerms}.

Additionally, the code uses declarativeNetRequest rules. At lib/ext.js:180, a rule is defined with regexSubstitution: https://search.${this.config.apiDomain}/crx/search.php?k=\1&action=ds&guid=${guid} and at :184 a regexFilter: https://search.${this.config.apiDomain}/search/(.*). This means any request matching that pattern (i.e., searches performed on the search page) is redirected to the /crx/search.php endpoint with the search terms and a unique GUID appended.

The extension also opens an extra tab to a URL supplied out-of-band. At lib/ext.js:203 and :213, it constructs a URL from a ty_url cookie value and calls openUrl(). This tab is likely used for further monetization or tracking.

Payload

The end result is that every search query a user types in the address bar or search box is sent to getbettersearch-api.com, not to the legitimate search provider they intended. The operator can log these queries, tie them to a persistent GUID, and possibly redirect to partner search engines or inject ads. This is affiliate fraud and a privacy violation.

Store status

The extension remains available in the Chrome Web Store as of this analysis. Users are advised to remove it immediately. No vendor response has been observed.