Wanderlustar Search and New Tab Hijacking

Overview

The Wanderlustar Chrome extension (store ID: bgliakflmjnofiolfmnbncdmgfnibgnj) with approximately 50,000 users hijacks the browser's default search engine and new tab page to redirect traffic to wanderlustar.com, a third-party domain controlled by the extension developer. This behavior is characteristic of search hijacking, a common monetization scheme where the operator earns revenue from redirected searches. The extension does not appear to perform any other covert or malicious activities beyond the hijacking, but the redirection itself poses privacy risks and degrades user control.

How it works

The extension uses the chrome_settings_overrides permission in its manifest to override the default search provider. The search URL https://wanderlustar.com/k?source=7023.139&a=&fp=0.0&na=10&rc=10&kw={searchTerms} includes multiple tracking parameters (source, a, fp, na, rc) that likely identify the extension instance and track user search queries. Additionally, the extension overrides the new tab page to load its own page (www/index.html) via chrome_url_overrides. Within that page, JavaScript code constructs requests to https://wanderlustar.com/3.json? (probably for configuration or ads) and to https://wanderlustar.com/sk?kw= with the user's search query when they use the search box on the new tab page. Finally, the extension sets a custom uninstall URL (https://wanderlustar.com/d.html?ti=2b5482ec-119c-11ee-a4f8-a24bae271909...) using chrome.runtime.setUninstallURL, allowing the developer to track uninstalls with a unique ID.

Payload

The payload is the redirection of all address-bar searches to wanderlustar.com and the presentation of a custom new tab page that also sends queries to the same domain. The tracking parameters embedded in the URLs enable the operator to collect search terms, timestamps, and other metadata. This data can be monetized through search advertising or sold to third parties. The extension does not steal credentials or inject malware, but the loss of privacy and control over search results is significant.

Store status

The extension remains active on the Chrome Web Store with approximately 50,000 users. The analysis was based on static code review and a sandbox run; no network traffic was captured due to the sandbox limitations. However, the manifest and script evidence conclusively show the hijacking behavior. Users who have installed this extension should remove it and manually reset their default search engine and new tab page settings. Review installed extensions and be wary of any that request permission to change search settings or new tab behavior.