Pomodoro Search Hijacker

Overview

The Pomodoro Chrome extension (store ID: mlfelkmlpmhleeclefagnddgocdngibo) claims to be a productivity timer but is, in its current build, a bare search hijacker. The extension's package contains only four files: manifest.json, icon_128.png, and locale files. There is no background script, no content script, and no timer logic anywhere in the extension. The only functional code is a chrome_settings_overrides entry in manifest.json that silently sets the browser's default search engine to https://pomodorosearch.com/search?v=1.0&id=ID&q={searchTerms}.

This behavior was reproduced in a sandbox: upon installation, the browser's search_provider was changed to the above URL. The sandbox observation directly matches the manifest declaration, confirming the override is active and intentional. The MalExt analysis labeled this extension as 'Search Hijacking' (v1.0), and our review concurs. This is a clear case of deceptive presentation: the extension does not deliver any Pomodoro functionality while hijacking the user's search.

How it works

The manifest.json file, at line 16, defines a chrome_settings_overrides object with a search_provider that includes "is_default": true and the search_url pointing to pomodorosearch.com. Chrome grants extensions that declare this override the ability to change the user's default search engine without any further user interaction beyond installation. The user may not notice the change until they perform a search, at which point all queries are routed through the third-party site, with an id parameter that can be used to track installation or user behavior.

Payload

The payload is minimal but effective: every search the user performs in the omnibox is sent to pomodorosearch.com, which likely monetizes the traffic through advertising or affiliate links. The id=ID placeholder suggests the URL template may be dynamically replaced with a unique identifier per installation, enabling per-user tracking. The extension does not request other permissions or perform additional data exfiltration in this build, but the search hijack alone compromises privacy and user expectations.

Store status

At the time of analysis, the extension remains listed on the Chrome Web Store with approximately 80,000 users. We recommend removing it immediately if installed. Users should also check their default search engine settings and restore their preferred provider (e.g., Google, Bing) if it was changed. No credential rotation is necessary unless the user interacted with the hijacked search results, but clearing browsing data related to search history may be prudent.