Is SpyHunter® Web Security safe?
We analyzed SpyHunter® Web Security version 1.11.1.96's actual code and gave it a 62/100 trust score. This is a broad but purpose-aligned security…
Bottom line
This is a broad but purpose-aligned security extension with notable URL-sharing, tracking, and page-handling concerns.
What it can access
It can observe all websites, inspect search links, redirect pages, and communicate with a companion app; this broadly supports protection but exceeds narrow site access.[Q1][Q2][Q5][Q12]
Security weaknesses
Remote rules can change which sites are blocked or checked, while a warning-page display flaw may allow crafted markup in that page.[Q16][Q17][Q18]
Signs of misuse
The extension sends selected full URLs and analytics, including a persistent ID and possibly hardware information, beyond the browser.[Q6][Q12][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site access, webRequest, tabs, storage, alarms and native messaging. Those powers are broad, but they support the disclosed URL reputation, blocking, search-result labeling, definition updates and companion-app integration.
Declares <all_urls>, webRequest, tabs, nativeMessaging and an all-sites content script. — manifest.json:3
Uses the permissions for definition storage, navigation checks, tab warnings, periodic updates and runtime coordination. — serviceworker.js:30-39
Provides controls for protection, blocking and individual search-engine hooks. — extension/data/options.js:9-23
Which websites can it run on, and can it read or change what appears on those pages?
It runs on all HTTP(S) pages, watches the current URL, and inspects search-result links on Google, Bing, Yahoo, DuckDuckGo and AOL. It adds reputation icons and warning pages but does not read arbitrary page text or form fields.
Injects the content bundle and styles on *://*/*. — manifest.json:3
Activates only on named search-engine URL patterns, extracts result links and inserts fixed icons/tooltips. — extension/data/webapp/main.js:14-55
Observes every top-level web request and passes its URL to checkUrl. — serviceworker.js:38
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Queries search-result anchors and inserts reputation UI; it does not attach input, change or submit listeners. — extension/data/webapp/main.js:20-55
Manual source searches found no first-party password or host-form capture path. — inventory.json:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It sees top-level browsing URLs and stores recent tab URLs locally so a warning page can return to the prior address. It does not request cookies, history, bookmarks or downloads.
Maintains a PouchDB tab URL cache and checks main-frame requests. — serviceworker.js:34-38
Queries/open tabs, caches permitted URLs and redirects malicious matches to packaged warning pages. — extension/WebSecurity.js:126-132
Requests tabs but not cookies, history, bookmarks or downloads. — manifest.json:3
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It connects to the fixed native host com.enigmasoftware.websecurity. The companion app returns activation, product, version and hardware-ID fields; no file, camera, microphone, location or clipboard access was found.
Connects to the fixed native host, sends init and stores five named response fields. — extension/WebSecurity.js:138-139
Requests nativeMessaging but no device-sensor or clipboard permission. — manifest.json:3
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It downloads threat definitions from EnigmaSoft. Suspicious-filter hits send the normalized full URL to EnigmaSoft's checker.
Downloads definition metadata/data from shbe.downloads.enigmasoft.net. — extension/WebSecurity.js:41,90-117
Sends normalized suspicious/selected unknown URLs to https://shws.enigmasoft.net/chk?url=. — extension/WebSecurity.js:128-142
Posts client/platform/product and aggregate security statistics to a fixed Google Analytics measurement endpoint. — extension/WebSecurity.js:56-60
Does it download or run code, settings, or instructions supplied by a remote server?
Downloaded definitions control safe/unsafe patterns and variables such as whether unknown URLs require backend checks. They can change blocking and disclosure behavior but are parsed as data; no downloaded response reaches eval or a script loader.
Parses, stores and periodically updates whitelist, blacklist and variable sections. — extension/WebSecurity.js:73-101,109-117
Uses downloaded matches and query_unknown_urls to choose local allow, block or backend-check actions. — extension/WebSecurity.js:128-137
The current full definition version has an empty variables list, leaving packaged query_unknown_urls=0 active. — live-definition-state-2026-09-29.json:1-12
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically checks each top-level navigation and can replace a malicious page with a warning. It also updates definitions and sends aggregate analytics on a schedule.
Starts periodic updates and invokes checkUrl for main-frame requests. — serviceworker.js:31-39
Automatically warns or blocks when definitions/backend classify a URL as unsafe. — extension/WebSecurity.js:128-137
Users can disable protection, blocking and individual search hooks. — extension/data/options.js:9-23
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Does not request proxy, privacy, search or management permissions. — manifest.json:3
Tab updates are used for packaged block/redirector pages and return navigation. — extension/WebSecurity.js:125-137
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party logic is compiler-minified and bundled with large third-party libraries, which slows review. Network services, analytics fields, native messaging and URL-check decisions remain readable; no encrypted application data was found.
Lists minified serviceworker/WebSecurity code plus PouchDB, jQuery, URI, Bloom filter and CryptoJS libraries. — inventory.json:1
Important destinations and source-to-sink paths remain explicit despite minification. — extension/WebSecurity.js:41,56-60,128-150
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Remote responses are parsed and stored as definition data, not evaluated. — extension/WebSecurity.js:90-117
Manual fixed-string and call-site searches found no first-party text-to-code path. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
It observes every top-level URL and supported search-result destination. Visited URLs are checked locally first; only suspicious-filter hits, or unknown URLs if a remote variable enables that mode, go to EnigmaSoft.
Receives every main-frame request URL through webRequest. — serviceworker.js:38
Reads result destinations on five supported search engines and sends them to local testUrls matching. — extension/data/webapp/main.js:19-55
Backend submission occurs for filter hits or when query_unknown_urls is enabled. — extension/WebSecurity.js:128-142
The current variable list is empty, so the default query_unknown_urls=0 applies. — live-definition-state-2026-09-29.json:1-12
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random client ID for analytics. If the trusted companion app is installed, its hardware ID is also included in aggregate analytics sent after definition updates.
Generates crypto.randomUUID() as stats.clientId and persists it in PouchDB. — extension/WebSecurity.js:73-74,102-103
Receives spyhunter_hwid from the native app and includes it with the client ID in analytics. — extension/WebSecurity.js:56-60,138-139
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not access cookies, sessions, credentials or page bodies. For suspicious-filter hits, it sends EnigmaSoft the normalized full URL, which can retain paths, queries and fragments.
Normalizes the parsed URL, preserving its path/parameters, URL-encodes it and requests the fixed backend checker. — extension/WebSecurity.js:140-142,151-152
Does not request cookie access. — manifest.json:3
The backend path is gated by a suspicious Bloom-filter match or the remote unknown-URL variable. — extension/WebSecurity.js:128-137
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Parses supported search-result anchors and injects icons without input or submit listeners. — extension/data/webapp/main.js:19-55
Declares no clipboard or capture permission. — manifest.json:3
Can a website or remote server send commands that make the extension take actions?
EnigmaSoft's definition server can change which URLs are considered safe/unsafe and can enable backend checks for unknown URLs. Packaged code limits responses to fixed matching, blocking and checking actions; remote JavaScript execution was not found.
Downloads remote Bloom filters, rules and variables on a six-hour schedule. — extension/WebSecurity.js:73-101,109-117
Remote list results control tab warnings and backend query selection. — extension/WebSecurity.js:128-142
Current definitions contain no variable overrides. — live-definition-state-2026-09-29.json:1-12
Does it alter links, referral codes, advertisements, shopping carts, or search results?
Search-result destinations are not replaced; fixed reputation icons and tooltips are added. Separately, a blocked URL from the warning-page query string is assigned to innerHTML, allowing crafted markup on the extension page.
Inserts fixed packaged icons beside result links without assigning new link destinations. — extension/data/webapp/main.js:20-55
Parses the continue query parameter and assigns it to validator-label-blocked-url-string.innerHTML. — extension/data/webapp/validator.js:3-4
Extension-page CSP restricts scripts to 'self' and objects to 'self'. — manifest.json:3
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes main-frame traffic and redirects locally or server-confirmed malicious URLs to packaged warning pages. This is the advertised blocking behavior; it does not rewrite headers, control downloads or configure a proxy.
Registers a non-blocking webRequest listener for all main-frame URLs. — serviceworker.js:38
Uses tabs.update to show packaged blocked pages and can restore a false-positive URL. — extension/WebSecurity.js:125-137
Does not request downloads or proxy permissions. — manifest.json:3
Can it communicate with software on the computer or services running on localhost?
It communicates with the fixed native host com.enigmasoftware.websecurity to detect the companion product. The exchange is limited to an init message and named product/version/hardware-ID response fields.
Connects to one fixed native application name and handles a small fixed response schema. — extension/WebSecurity.js:138-139
Requests nativeMessaging. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Definition content reaches fixed parsers and local PouchDB storage. — extension/WebSecurity.js:73-101,109-117
importScripts loads only literal packaged library and application paths. — extension/serviceworker.js:29-30
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable declaration. — manifest.json:3
Uses chrome.runtime messaging directly and has no page-window bridge. — extension/data/common/communicator.js:1-4
The warning page sends excludeUrl only from the visible confirmation click. — extension/data/webapp/validator.js:3-4
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses local options, downloaded patterns and query_unknown_urls to select behavior. — extension/WebSecurity.js:41,73-101,128-137
Current variables.items is empty. — live-definition-state-2026-09-29.json:1-12
Exposes user controls for protection, blocking and search hooks. — extension/data/options.js:9-23
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Sets content.updateInterval to 30 and repeatedly checks the current URL/search-engine state. — extension/data/webapp/main.js:14-19
Manual review found no mining endpoint, hashing loop for proof-of-work or worker pool. — inventory.json:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Search integrations inspect anchors and add icons/tooltips; no form action or submit handler is present. — extension/data/webapp/main.js:20-55
Manual searches found no first-party form.action or setAttribute('action') mutation. — inventory.json:1