Is Online Security safe?
We analyzed Online Security version 7.6.0's actual code and gave it a 38/100 trust score. This is a powerful security extension with broad monitoring,…
Bottom line
This is a powerful security extension with broad monitoring, data sharing, and privileged controls that create substantial privacy and misuse risk.
What it can access
It can inspect all websites plus cookies, history, downloads, settings, and other extensions, which is extensive even for security software.[Q1][Q4][Q14]
Security weaknesses
Approved provider websites can invoke powerful browser and native-computer actions without separate approval for most operations.[Q19][Q21]
Signs of misuse
It sends browsing details, persistent tracking data, and sometimes full destination URLs or social-ad records to its provider.[Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has unusually broad access: every website, tabs, history, cookies, downloads, content settings, browsing-data deletion, extension management, native messaging, and persistent storage. This breadth supports a security product but creates a large impact if the extension or a trusted vendor origin is compromised.
Declares <all_urls>, an all-site content script, and permissions for management, tabs, downloads, webNavigation, contentSettings, browsingData, history, nativeMessaging, and cookies. — manifest.json:3
Implements site scanning, cookie and site-data controls, extension management, download handling, and a native-host channel. — background.bundle.js:40
Which websites can it run on, and can it read or change what appears on those pages?
A page access runs on every site. It normally adds protection UI, scans page links only after the user chooses the page-scan command, and can inspect social-network responses when remote feature flags enable ad scanning.
Loads contentScript.bundle.js on <all_urls>. — manifest.json:3
The anti-phishing page-link scan is message-triggered; separate remotely flagged modules inject packaged Facebook, Instagram, and TikTok ad detectors. — contentScript.bundle.js:51
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can reach sensitive browser data through history and cookies, and optional social-ad detectors inspect network response objects. No code was found that reads typed passwords, arbitrary form values, private messages, or payment fields.
Reads browsing history and exposes a cookie lookup function to the allowlisted external website channel. — background.bundle.js:40
Feature-flagged social detectors forward captured ad records, not arbitrary forms or messages. — contentScript.bundle.js:51
The Instagram detector extracts sponsored-post metadata from feed responses. — assets/images/inig.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads browsing history, installed-extension metadata, cookies, tab URLs, and local extension state. It can also delete history, cookies, cache, local storage, service workers, and related site data.
Requests history, management, cookies, tabs, browsingData, storage, and unlimitedStorage. — manifest.json:3
Uses chrome.history.search, chrome.management.getAll, cookie APIs, tab APIs, and chrome.browsingData.remove. — background.bundle.js:40
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It monitors downloads and can open downloaded files or pass a completed Windows file path to the installed ReasonLabs native scanner. No camera, microphone, geolocation, clipboard-read, or arbitrary local-file read path was found.
Requests downloads, downloads.open, downloads.shelf, and nativeMessaging but no camera, microphone, geolocation, or clipboard permission. — manifest.json:3
Watches completed downloads and invokes scanFileWithRTP through the native channel when the local antivirus service is installed. — background.bundle.js:40
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends visited site origins, installed extension IDs, security events, persistent identifiers, and product telemetry to ReasonLabs/Mozo services. Remotely enabled modules can additionally send complete destination URLs and social-ad response data.
Posts origin-only URL checks to extgw.mozoapi.com, extension IDs to its extension scanner, analytics to pac.rlpaservices.com, and feature-flagged full redirect targets to the URL-report endpoint. — background.bundle.js:40
Uploads previously unseen Facebook, Instagram, or TikTok ad records when the corresponding feature flag is enabled. — contentScript.bundle.js:51
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads remote configuration, GrowthBook feature flags, reputation verdicts, and notification templates. These inputs select packaged behavior and UI; no remote JavaScript reaches an execution sink.
Fetches configuration from config.reasonsecurity.com, feature flags from ab.reasonlabsapi.com, verdicts from extgw.mozoapi.com, and notification data from cdn.reasonlabs.com. — background.bundle.js:40
Uses remote flags and data to enable packaged detectors and render packaged protection interfaces. — contentScript.bundle.js:51
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Site and extension scanning are enabled by default. Site visits are checked automatically, scheduled scans inspect recent history and installed extensions, and an extension marked unsafe by the service can be disabled automatically unless whitelisted.
Default settings enable real-time site and extension scanning plus smart scheduled scans; navigation and management listeners run those checks automatically. — background.bundle.js:40
Calls chrome.management.setEnabled(false) when the extension-reputation service returns a non-ok verdict and the item is not whitelisted. — background.bundle.js:40
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It can change per-site camera, microphone, cookie, location, JavaScript, notification, and popup settings, clear browsing data, and enable or disable other extensions. It does not configure a browser proxy, homepage, or search provider.
Requests contentSettings, browsingData, management, and declarativeNetRequest permissions. — manifest.json:3
Implements site-permission changes, site-data deletion, and other-extension enable/disable controls. — background.bundle.js:40
Rewrites CORS response headers for requests to apis.reasonsecurity.com. — rules.json:1-35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main JavaScript is heavily bundled and minified, which makes review harder. Named modules, readable strings, and consistent product flows remain visible, so minification alone is not evidence that behavior was intentionally hidden.
Contains a large minified Webpack bundle with identifiable modules, endpoints, and Chrome API calls. — background.bundle.js:1-40
Contains the minified all-sites content application and protection modules. — contentScript.bundle.js:1-51
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The package contains eval and new Function, but remote code execution was not demonstrated. The eval builds a constructor from packaged ASN.1 schema text with a normal fallback, and the Function calls are bundled library/global-object fallbacks rather than remote data execution.
A bundled ASN.1 helper uses eval on locally generated constructor source and catches failure; no remote input path reaches the source string. — background.bundle.js:28
Contains a new Function global-object fallback in bundled library code. — contentScript.bundle.js:51
Contains the equivalent bundled new Function fallback. — index.bundle.js:51
Does it track the websites, pages, searches, or links you visit?
It observes top-level navigation and scans up to 30 days of browser history. Normal reputation checks reduce URLs to scheme plus hostname, but remotely enabled traffic-source protection sends full cross-site destination URLs with paths and queries.
Normalizes default site checks to scheme plus hostname, reads up to 10,000 recent history records, and posts unknown origins to the reputation service. — background.bundle.js:40
The traffic_source_protection feature registers webNavigation listeners and posts target_url without removing its path or query. — background.bundle.js:40
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and stores persistent ext_uid and ruserid identifiers, affiliate/UTM values, install time, and analytics state. Product events include those identifiers plus browser, OS, device, screen, subscription, and feature-assignment metadata.
Generates UUID-based ext_uid/ruserid values, persists tracking parameters in storage and vendor cookies, and includes them in PAC analytics and the uninstall URL. — background.bundle.js:40
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads its own vendor authentication cookies for normal authenticated services calls. More importantly, its allowlisted website bridge exposes chrome.cookies.get for an arbitrary URL and cookie name; this is a confirmed capability, but use against unrelated sessions was not observed.
Reads access_token and refresh_token from the vendor application domain and uses the access token for ReasonLabs/Mozo APIs. — background.bundle.js:40
Adds chromeCookies.get, bound directly to chrome.cookies.get, to the generic external website API. — background.bundle.js:40
Cookie and <all_urls> permissions give that lookup broad reach, while externally_connectable limits callers to five vendor-controlled origin patterns. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Contains no first-party keyboard/input capture path; the Gmail-specific notification reads only the title and the social modules process sponsored-ad records. — contentScript.bundle.js:51
Requests no desktopCapture, tabCapture, or clipboard-read permission. — manifest.json:3
Can a website or remote server send commands that make the extension take actions?
Vendor services influence blocking, extension disabling, notifications, and remotely flagged telemetry. This is server-controlled security behavior rather than a demonstrated hostile command channel, but a compromised service could cause false blocking or activate the packaged reporting features.
Uses remote site/extension verdicts to redirect tabs or disable extensions and uses remote configuration and GrowthBook flags to select behavior. — background.bundle.js:40
Checks remote feature flags before enabling social-ad inspection and reporting. — contentScript.bundle.js:51
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It adds security and marketing notices to pages, places verdict icons beside torrent links, can prevent clicks on links judged unsafe, and redirects malicious tabs to its packaged block page. These edits support its product purpose and were not shown altering purchases, ads, or referrals.
Injects protection notifications and torrent-status elements, and prevents clicks on torrent links that the service did not mark safe. — contentScript.bundle.js:51
Redirects tabs matching a blocked origin to the extension's local Blocked page unless allowed once. — background.bundle.js:40
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It monitors completed downloads, can open files, sends a local file path to the native scanner, and rewrites CORS response headers for one vendor services. It does not request or configure a proxy and no arbitrary download replacement was found.
Requests downloads and declarativeNetRequest permissions but not proxy. — manifest.json:3
Sets permissive CORS response headers for apis.reasonsecurity.com. — rules.json:1-35
Observes download state and passes completed Windows paths to the installed native antivirus for scanning. — background.bundle.js:40
Can it communicate with software on the computer or services running on localhost?
It sends path-based commands and arguments to the com.reasonlabs.extension native host. This is an intended services-security integration, but the generic external website bridge also exposes the native proxy when the host is installed.
Requests nativeMessaging. — manifest.json:3
Forwards method paths and the first argument through chrome.runtime.sendNativeMessage to com.reasonlabs.extension and places that proxy in the website-callable API object. — background.bundle.js:40
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote data is used as configuration, templates, and verdicts; the bundled eval has no path from those inputs. — background.bundle.js:28,40
Feature flags enable packaged social-detector files rather than providing executable source. — contentScript.bundle.js:51
Declares a Manifest V3 service worker and packaged content script. — manifest.json:3
Can ordinary websites access privileged extension features through messaging or exposed files?
Five vendor-controlled web origin patterns can connect to a generic RPC dispatcher and invoke any non-reserved function reachable in its large services object. That includes raw cookie lookup, tab operations, site-data deletion, extension controls, local storage, and native-host calls; there is no per-method allowlist or user confirmation for most operations.
externally_connectable allows *.reasonlabs.com, onlinesecurity-app.com, onlinesecurityext.com, insights.onlinesecurityext.com, and app.getmozo.com. — manifest.json:3
The WebsiteChannel accepts external ports and resolves arbitrary dot-separated paths, rejecting reserved property names but applying no method-specific authorization. — background.bundle.js:1
Supplies the dispatcher with cookie, extension, engine, tab, browsing-data, settings, storage, notification, and other privileged services. — background.bundle.js:40
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Important behavior depends on remote configuration, account state, platform, and visited site. Full redirect reporting and Facebook, Instagram, or TikTok ad collection are present but require remote flags; their current enabled state was not demonstrated.
Registers redirect tracking only when the traffic_source_protection GrowthBook flag is enabled. — background.bundle.js:40
Enables each social detector only on its matching domain and only when the corresponding remote flag is on. — contentScript.bundle.js:51
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains the extension's security, telemetry, scheduling, and native integration logic without a mining path. — background.bundle.js:1-40
Declares no remote worker or resource associated with mining. — manifest.json:3
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
First-party page code adds protection UI and social/torrent detectors but contains no form-action or generic input interception flow. — contentScript.bundle.js:51
Navigation changes route sites classified as malicious to a packaged warning page rather than altering form submissions. — background.bundle.js:40