OmniSearch browser extension hijacks default search and sends telemetry to Lavasoft

Overview

OmniSearch is a Chrome extension with approximately 80,000 users that sets the browser's default search engine to defaultsearch.co without clear disclosure. It also collects telemetry data and sends it to Lavasoft servers, including install ID, timestamps, and browser environment information. The extension sets a third-party uninstall URL to track removals. This behavior is consistent with search hijacking and unwanted data collection.

How it works

The extension leverages the chrome_settings_overrides permission in its manifest to override the default search provider. The manifest (line 14-22) defines a search provider named "Default Search" with keyword "defaultsearch.co" and a search URL https://defaultsearch.co/?sp=11&q={searchTerms} with is_default set to true. This change is applied immediately upon installation, redirecting all address-bar searches to the third-party domain.

Additionally, telemetry is implemented through configuration stored in js/config.js (line 4), which sets flowUrl to https://flow.lavasoft.com/v1/event-stat?. The file js/telemetry.js (line 5) retrieves this URL and uses it to send data. The function trackingData in js/trackingDataUtil.js (lines 128-131) assembles payloads containing browser environment data, install data, install ID, and external data, which are then transmitted to the Lavasoft endpoint.

When the extension is uninstalled, it sets an uninstall URL to https://mynewtab.co/omnibox/uninstall.html? via js/start.js (line 11) and js/trackingDataUtil.js (lines 103-108) using chrome.runtime.setUninstallURL. This allows the operator to track uninstalls and potentially display a page to the user.

Payload

The primary payload is browser redirection: all searches are routed through defaultsearch.co, which may inject ads or collect queries. The telemetry payload includes sensitive metadata such as install ID, which can be used to correlate user activity across sessions. The uninstall URL enables tracking of user churn and possibly presenting retention offers.

Store status

The extension remains available on the Chrome Web Store at the time of analysis, with approximately 80,000 reported installs. Users should remove the extension and reset their default search engine settings. Administrators should block the extension ID djgflnccplcmifemnpgnkkdblihncpmm and domains defaultsearch.co, flow.lavasoft.com, and mynewtab.co to prevent further data leakage.