Is seats.aero safe?
We analyzed seats.aero version 1.3.43's actual code and gave it a 82/100 trust score. This appears to be a legitimate travel-search extension with…
Bottom line
This appears to be a legitimate travel-search extension with moderate page access and some uncertainty from compressed code, but no established abuse.
What it can access
The extension can read and modify supported Google Flights and travel-booking pages, and can process related search information for its award-search feature. [Q1] It sends travel-search and configuration information to seats.aero, so its access is broader than display-only assistance. [Q6]
Signs of misuse
The review found no established collection of passwords, payment details, cookies, or arbitrary browsing history. [Q3] [Q4] Remote settings can disable named features, but no downloaded code execution, deceptive manipulation, or other harmful use was established. [Q7] [Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests limited access to its own site and specific travel-search pages, plus temporary access to the active page and stored settings; this fits its stated award-search purpose, although it processes travel searches and sends related data to seats.aero.
The manifest declares activeTab and storage permissions, optional scripting, seats.aero access, optional Amex Travel access, and content scripts limited to Chase Travel, Google Flights, and seats.aero pages. — manifest.json:1
The extension description states that it searches award availability on Google Flights, Chase Travel, and Amex Travel. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://seats.aero/*, https://www.travel.americanexpress.com/* — manifest.json:1
Content scripts run directly on: https://travelsecure.chase.com/*, https://travelsecure.chase.com/*, https://www.google.ca/travel/flights*, https://www.google.co.uk/travel/flights*, https://www.google.com.au/travel/flights*, https://www.google.com/travel/flights*, https://www.google.de/travel/flights*, https://www.google.fr/travel/flights* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension runs on supported travel-search pages and reads travel-search results, but the inspected code does not establish collection of passwords, payment details, messages, or arbitrary form entries. No source-to-exfiltration path for those values was identified.
Content scripts are limited to specified Google Flights, Chase Travel, Amex Travel, and seats.aero pages; no general all-site form script is declared. — manifest.json:20-61
The main-world script is used to observe selected Chase travel responses, not shown collecting password or payment fields. — content-scripts/chase-main.js:1
The main-world script is used to observe selected Amex offer responses, not shown collecting password or payment fields. — content-scripts/amex-travel-main.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension has no cookies, history, bookmarks, or downloads permission. It can make requests using the current travel site's session and read limited page-visible data, but that is not evidence of broad private-browser-data access.
Declared permissions are activeTab and storage; no cookies, history, bookmarks, or downloads permission is declared. — manifest.json:20-43
Credentialed requests and limited page-context cookie use support Chase's own travel requests; they do not establish broad cookie or session extraction. — content-scripts/chase.js:8
Uses extension messaging and storage/reference data, not browser history, bookmarks, or downloads APIs. — content-scripts/amex-travel.js:8
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends its version and travel-search-related data to seats.aero and makes normal requests to supported travel services. These requests support configuration, reference data, user or feature state, and award-availability processing.
Posts the installed version to the seats.aero configuration endpoint and receives configuration data. — background.js:6
Requests Chase travel criteria and extension reference data while processing Chase searches. — content-scripts/chase.js:8
Requests seats.aero reference data while processing Amex travel offers. — content-scripts/amex-travel.js:8
Observes selected Chase travel search responses for availability processing. — content-scripts/chase-main.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads remote JSON configuration and reference data, including kill-switch values, and uses those values to enable or disable named adapters. The inspected code does not show the downloaded responses being executed as JavaScript.
Fetches the seats.aero configuration endpoint, parses the response, and stores the returned configuration. — background.js:6
The killswitch lookup returns true only for named configuration flags. — background.js:6
The Google Flights adapter checks a remotely supplied kill-switch result before starting. — content-scripts/content.js:8
The Chase adapter checks a remotely supplied kill-switch result before starting. — content-scripts/chase.js:8
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can open seats.aero pages when installed, updated, or when the extension button is clicked, and it performs background network requests while processing supported travel pages. The source shown does not demonstrate arbitrary downloads or search redirection.
Installation handling opens the seats.aero welcome page. — background.js:6
The action-click handler opens seats.aero or a generated search URL. — background.js:1
Performs background requests for travel criteria and reference data. — content-scripts/chase.js:8
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the principal service-worker and content-script files are very large, compressed bundles with extremely long lines. This reduces practical auditability, although minification alone is not evidence of malicious behavior.
The service-worker bundle is approximately 133 KB and compressed into a few very long lines. — background.js:1-6
The Google Flights bundle is approximately 585 KB and heavily compressed. — content-scripts/content.js:1-8
The Chase bundle is approximately 520 KB and heavily compressed. — content-scripts/chase.js:1-8
The Amex bundle is approximately 524 KB and heavily compressed. — content-scripts/amex-travel.js:1-8
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct use of eval(), new Function(), or string-based timers was found in the inspected source search. Ordinary callback-based setTimeout calls are present, which do not turn text into code.
Search results showed callback-based setTimeout usage, not a string argument. — background.js:1-6
Search results showed callback-based timer usage and no direct eval or new Function match. — content-scripts/content.js:1-8
Search results showed callback-based timer usage and no direct eval or new Function match. — content-scripts/chase.js:1-8
Does it track the websites, pages, searches, or links you visit?
The extension observes and processes searches and result data on supported Google Flights, Chase Travel, and Amex Travel pages. The inspected code does not establish broad tracking of every website or a general browsing-history collector.
Content scripts are restricted to named Google Flights, Chase Travel, Amex Travel, and seats.aero URL patterns. — manifest.json:20-61
The Chase main-world script observes selected travel-search responses. — content-scripts/chase-main.js:1
The Amex main-world script observes selected offer responses. — content-scripts/amex-travel-main.js:1
The Google Flights adapter starts only on the manifest's supported Google travel pages and processes flight-search information. — content-scripts/content.js:8
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent identifier or browser-fingerprint collection was found. Random UUIDs are used to match individual background fetch requests, not clearly to recognize a user.
crypto.randomUUID() creates request IDs for aborting and correlating BG_FETCH operations. — content-scripts/content.js:8
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension makes requests that may use the current travel site's normal session credentials, but the inspected code does not show cookies or authentication data being copied and sent to another destination. `credentials: include` alone does not establish credential theft.
The service worker sends the extension version to seats.aero with a credentialed request; this does not show cookie values being read or exposed. — background.js:6
Chase-related credentialed requests are made in support of the current site's travel workflow. — content-scripts/chase.js:8
Background-fetch messaging supports extension network requests but does not by itself establish page-cookie or authentication-data exfiltration. — content-scripts/content.js:8
Does it record typing, form entries, clipboard contents, or screenshots?
No typing logger, form-entry recorder, clipboard monitor, or screenshot capture was found. Clipboard reads appear limited to handling paste into numeric input controls.
clipboardData is read only during a numeric-input paste handler. — content-scripts/chase.js:8
The same clipboard handling is tied to numeric input validation. — content-scripts/amex-travel.js:8
Can a website or remote server send commands that make the extension take actions?
The service worker accepts messages from extension content scripts and has an external-message listener limited by the manifest to seats.aero pages. The compressed handler could not be fully traced to rule out every externally triggerable privileged action.
External connections are permitted only from https://seats.aero/*. — manifest.json:43-50
Registers both an internal runtime message listener and an onMessageExternal listener; the external handler includes a PING response and rejects unknown message types, but the complete dispatch and all callers are difficult to audit in the. — background.js:6
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The code is designed to add award-search information to travel pages and open seats.aero searches. No evidence was found that it changes referral codes, advertisements, shopping carts, or general search results.
The action handler opens a seats.aero URL based on parsed search parameters. — background.js:6
The content script updates travel-page display elements for award-search results. — content-scripts/content.js:8
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No webRequest interception, proxy configuration, header rewriting, or download interception was found. The extension does hook page XMLHttpRequest methods to observe relevant travel responses, but this is page-specific processing rather than demonstrated traffic redirection.
Permissions do not include webRequest, proxy, downloads, or broad host access. — manifest.json:1-1
Hooks XMLHttpRequest.open and send to inspect matching Chase responses. — content-scripts/chase-main.js:1
Hooks XMLHttpRequest.open and send to inspect matching Amex responses. — content-scripts/amex-travel-main.js:1
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost request, or other computer-software communication was found.
The manifest declares no nativeMessaging permission and no localhost host permission. — manifest.json:1-1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence was found that the extension decrypts or unpacks hidden data and then executes or injects it. The main-world scripts hook XMLHttpRequest and process returned travel data.
Installs XMLHttpRequest hooks and parses matching response JSON. — content-scripts/chase-main.js:1
Installs XMLHttpRequest hooks and parses matching response JSON. — content-scripts/amex-travel-main.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Only seats.aero pages are declared externally connectable, so ordinary unrelated websites cannot use the extension's external messaging interface. The compressed external handler is only partly traceable, preventing a complete determination of which privileged operations that allowed origin can request.
externally_connectable.matches contains only https://seats.aero/*. — manifest.json:43-50
An onMessageExternal listener is registered and visibly handles a limited PING-style message, but the full handler and all downstream privileged sinks are difficult to verify. — background.js:6
No web_accessible_resources declaration is present, so the manifest does not expose extension files to ordinary websites through that mechanism. — manifest.json:1-61
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Remote configuration can change whether named travel adapters run by returning kill-switch values from seats.aero. This permits behavior changes for users without an extension update, but the inspected path shows feature gating rather than activation of an undisclosed harmful payload.
Fetches configuration from the seats.aero endpoint and stores the returned kill-switch data. — background.js:6
The kill-switch helper checks named adapter identifiers and returns true only when the corresponding remote flag is true. — background.js:6
The Google Flights adapter exits when its remotely supplied killed flag is true. — content-scripts/content.js:8
The Chase adapter similarly exits when its remotely supplied killed flag is true. — content-scripts/chase.js:8
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining loop or other concealed resource-intensive computation was found. The visible work is page scanning, network requests, and UI updates for flight searches.
Background initialization centers on configuration, messaging, tabs, and fetch handling. — background.js:6
Content processing is tied to travel-search page updates. — content-scripts/content.js:8
Does it change form fields or where a form sends its information?
No evidence was found that it changes form destinations or submits forms elsewhere. It does modify some numeric input behavior by filtering pasted characters, which is input validation rather than changing where form data is sent.
Numeric-input handler filters pasted text to digits and applies maxLength. — content-scripts/chase.js:8
Numeric-input handler performs the same digit filtering. — content-scripts/amex-travel.js:8