Rewards Search Automator CDP debugger and <all_urls> account-ban risk

Overview

Rewards Search Automator v1.6.5 (Chrome Web Store ID: eanofdhdfbcalhflpbdipkjjkoimeeod) is a Bing/Microsoft Rewards automation tool with ~60,000 installs. It attaches the Chrome DevTools Protocol (CDP) debugger to tabs and replays search keystrokes to accrue reward points, and on rewards.bing.com it reads the user's own counter data from Bing's API. The extension does not send browsing data, cookies, or credentials to any third party; the only external endpoints are Bing (for the automation), Gumroad (for a Pro license), and a Notion privacy policy. This behavior is not data theft but violates Microsoft Rewards terms and can lead to account suspension or ban.

How it works

The extension requests the debugger permission (manifest.json:38) and attaches to tabs using chrome.debugger.attach({ tabId }, "1.3") (js/service.js:368), then uses the CDP to simulate user input on Bing search pages. It also requests broad host permissions <all_urls> (manifest.json:40) plus tabs, history, browsingData, and webNavigation (manifest.json:37), although the stated purpose is limited to Bing. On rewards.bing.com, the content script fetches https://rewards.bing.com/api/getuserinfo (js/content.js:301) and logs the user's own point counters (js/content.js:316); that data is not exfiltrated.

Payload

No remote configuration or script loader exists: the extension only references a Notion privacy policy (js/service.js:11) and a Gumroad search for a Pro license (js/popup.js:4). The sandbox run was inconclusive because the manifest declares default_popup /popup.html but the code attempted to load popup/main.html (ERR_FILE_NOT_FOUND), so no dynamic network or injection behavior was observed. Only version 1.6.5 was examined; earlier builds may have differed. The debugger attachment may not be strictly limited to bing.com tabs, though that was not fully traced.

Store status

The extension remains active on the Chrome Web Store with ~60,000 users as of the bench date. We recommend removal if you do not want to risk your Microsoft Rewards account. The debugger permission alone is flagged by Chrome as high-risk because it can read and change all data on any website.