Is Yahoo Sports OneClick safe?
We analyzed Yahoo Sports OneClick version 11's actual code and gave it a 45/100 trust score. This extension provides sports scores but combines…
Bottom line
This extension provides sports scores but combines unnecessary all-site access with persistent Yahoo tracking.
What it can access
It runs on every website and sends recurring usage signals linked to a persistent ID, exceeding what a score display needs.[Q1][Q6][Q13]
Security weaknesses
Universal page access and automatic activity reporting create unnecessary exposure and could affect unrelated sites.[Q1][Q2][Q8]
Signs of misuse
The extension silently reports page-load and interaction signals to Yahoo and links them over time with a persistent ID.[Q6][Q8][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It declares a page access on <all_urls>, giving popup.js the ability to run in every ordinary webpage. It requests no named Chrome services permissions, but universal site injection is much broader access than a score popup needs.
Runs popup.js at document_end on <all_urls>. — manifest.json:content_scripts
Which websites can it run on, and can it read or change what appears on those pages?
On every site it queries the page for several generic class names and attaches click listeners when matching elements exist. It does not otherwise read page text or intentionally change page content, and the listener callbacks appear broken because popup-only globals are absent on normal pages.
Queries .listOptions, .link_wrapper, .dropdownWrapper, .game_list_wrapper, and .ad_wrapper and conditionally adds click handlers. — popup.js:1-41
Injects that script into all URLs rather than only the extension popup. — manifest.json:content_scripts
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Contains selector lookups and click handlers but no form, input, value, keypress, or text extraction. — popup.js:1-41
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores a randomly generated persistent tracking ID, first-run state, and first-run time in the popup's localStorage. It does not request Chrome cookie, history, bookmark, download, or storage permissions.
Creates and saves ctid in window.localStorage and reads version, UI language, and OS. — BrowserGap.js:32-42, 133-141
Stores first-run completion and timestamp in localStorage. — index.js:20-30
Declares no permissions array for cookies, history, bookmarks, downloads, or storage. — manifest.json:top-level fields
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No permissions or host declarations grant these capabilities. — manifest.json:top-level fields
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends Yahoo a persistent tracking ID, extension version, language/market, distribution code, browser, operating system, event type, and popup interaction labels. Because every webpage triggers the page-info path, Yahoo also receives a timestamped signal for each page load even though the page URL and title are not included.
Defines page and click beacon fields including ctid, locale, version, browser, OS, section, and link labels. — Constants.js:14-55
Constructs geo.yahoo.com beacon URLs from those fields and sends them by XHR. — TrackingManager.js:95-124
Sends popupOpen on every document where the all-sites script runs. — popup.js:1-2
Turns every popupOpen message into a Yahoo page-info beacon. — index.js:46-54
Does it download or run code, settings, or instructions supplied by a remote server?
The popup downloads live score data and a Yahoo-controlled advertising configuration. The remote configuration supplies the promotional link, icon, and text shown to the user; index.html also loads a remote stylesheet.
Fetches td-app-sports.json and renders its link, icon, and text in the popup. — static/js/main.1a3bbfa3.js.map:sources configs/blender.js, utils/getAd.js, and components/App.js
Loads slick.min.css from cdnjs.cloudflare.com. — index.html:head
Fetches Yahoo scoreboard JSON and treats it as data. — background.js:1-27
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The all-sites script automatically reports each page load to the extension, which automatically emits a Yahoo telemetry beacon without the user opening the popup. The background also polls Yahoo scores every five minutes, and the open popup refreshes scores every ten seconds.
Automatically sends popupOpen on DOMContentLoaded in every matching page. — popup.js:1-2
Automatically sends a page-info beacon upon receiving the message. — index.js:46-54
Starts immediately and polls the score API on a five-minute interval. — background.js:30-49
Refreshes popup score data every 10 seconds while mounted. — static/js/main.1a3bbfa3.js.map:source components/App.js
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no chrome_url_overrides, search_provider, proxy, or settings override. — manifest.json:top-level fields
Shows older intended behavior that is absent from the active manifest. — backup_manifest.json:legacy configuration
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup application is a minified legacy React bundle, which makes direct reading harder, but its included source map exposes the original first-party source and makes the important behavior understandable. The small tracking scripts are readable.
Contains a minified 295 KB React application and dependencies. — static/js/main.1a3bbfa3.js:entire file
Includes original source names and source content for the popup application. — static/js/main.1a3bbfa3.js.map:sources and sourcesContent
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses setInterval with a function callback. — background.js:30-46
Uses setInterval with a function callback for the alive beacon. — TrackingManager.js:131-149
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Runs the signaling script on every URL at document_end. — manifest.json:content_scripts
Signals popupOpen on each matching document load without including a URL. — popup.js:1-2
Converts that signal into a Yahoo tracking request. — index.js:46-54
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a 36-character random ctid, keeps it in localStorage, and attaches it to Yahoo page and click telemetry, allowing activity from the same installation to be linked over time.
Loads or generates the random ctid and persists it in localStorage. — BrowserGap.js:32-78
Includes ctid in both page-info and click-info beacon templates. — Constants.js:14-55
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or identity permission is declared. — manifest.json:top-level fields
Fetches a public scoreboard URL without credentials or authorization headers. — background.js:1-27
Does it record typing, form entries, clipboard contents, or screenshots?
It observes clicks on page elements whose generic class names happen to match its popup selectors. It does not read typed text, selections, clipboard contents, screenshots, camera, or microphone data.
Adds click listeners to matching .link_wrapper, .dropdownWrapper, .game_list_wrapper, and .ad_wrapper elements. — popup.js:4-41
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Fetches Yahoo's chromeExtension advertisement configuration. — static/js/main.1a3bbfa3.js.map:sources configs/blender.js and utils/getAd.js
Uses remote adObj.link, adObj.icon, and adObj.text in a popup anchor and image. — static/js/main.1a3bbfa3.js.map:source components/App.js
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Renders remote promotional content in .ad_wrapper. — static/js/main.1a3bbfa3.js.map:source components/App.js
Labels clicks in .ad_wrapper as an Ad event for telemetry. — popup.js:38-40
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission is declared. — manifest.json:top-level fields
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission or loopback/private-network host is declared. — manifest.json:top-level fields
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses remote responses as JSON objects used for scores and promotion fields. — static/js/main.1a3bbfa3.js.map:sources utils/getData.js and utils/getAd.js
References only packaged JavaScript files. — manifest.json:background and content_scripts
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains neither web_accessible_resources nor externally_connectable. — manifest.json:top-level fields
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior changes with visible league selections and ordinary Yahoo score/ad responses. — static/js/main.1a3bbfa3.js.map:sources components/App.js and configs/blender.js
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Injects popup.js after every page load. — manifest.json:content_scripts
Runs a five-minute scoreboard polling loop. — background.js:30-49
Runs a ten-second score refresh loop while the popup is open. — static/js/main.1a3bbfa3.js.map:source components/App.js
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Contains no form, input, value, action, submit, or mutation logic. — popup.js:1-49