Is Multiple Search Engines - MSE safe?
We analyzed Multiple Search Engines - MSE version 1.2.5's actual code and gave it a 86/100 trust score. This appears to be a purpose-aligned search helper…
Bottom line
This appears to be a purpose-aligned search helper with broad but currently inactive page coverage and no established abuse.
What it can access
It covers all websites, but its active feature uses only deliberately selected text plus local settings, matching its search purpose. [Q1] [Q2]
Security weaknesses
No meaningful weakness was found; the broad page coverage is inactive, and searches require a user menu action. [Q1] [Q8]
Signs of misuse
There is no evidence of tracking, private-data collection, hidden actions, or remote control; selected text goes only to chosen search destinations. [Q6] [Q12] [Q14] [Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests context-menu and storage permissions. A page access is declared on all URLs, but its file is empty.
Declares an all-URL content script plus contextMenus and storage. — manifest.json:14-22,48-49
The declared content-script file is zero bytes and performs no action. — js/content-script.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It receives only the text the user deliberately selects and submits through its context menu; it does not scrape page content.
Context-menu click handling passes Chrome's selectionText to the chosen search action. — js/background.js:358-399
Contains no DOM-reading code. — js/content-script.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only page-derived input is the selectionText provided for a user-invoked context-menu action. — js/background.js:36-64,358-399
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests no history, bookmarks, cookies, tabs or downloads permission. — manifest.json:48-49
Reads and writes the extension's search-engine configuration. — js/controller.js:5-20,64-77
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of these permissions. — manifest.json:48-49
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
After an explicit context-menu action, it sends the selected text as part of the chosen search URL. The destination is visible and user-configurable.
URL-encodes selectionText, substitutes it for %s and navigates to the resulting URL. — js/background.js:36-64
The options page lets the user add and edit search destinations. — js/controller.js:113-143
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Defines packaged default search-engine configuration. — js/service.js:10-55
Loads configuration from local storage and permits a user-pasted JSON import. — js/controller.js:5-20,208-225
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
The search flow begins in chrome.contextMenus.onClicked. — js/background.js:358-403
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests only contextMenus and storage. — manifest.json:48-49
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The options page includes minified Angular, jQuery and UI libraries, but the extension's own search logic is readable and not obfuscated.
Loads packaged framework libraries and readable application scripts. — options.html:113-126
Core behavior is unobfuscated source code. — js/background.js:1-404
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The packaged Angular library defines Function-based expression compilation and a capability test. — js/lib/angular.min.js:106,162
Selected text is URL-encoded and used only in navigation, not executable-code sinks. — js/background.js:36-64
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses selectionText and search-engine configuration without reading tab.url. — js/background.js:36-64,358-399
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Includes a trackGA flag but no active analytics implementation. — js/service.js:10-18
Analytics calls are commented out. — js/controller.js:187-210
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies, identity or webRequest permission. — manifest.json:48-49
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The all-site content script is empty. — js/content-script.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The user can paste JSON configuration into the options page. — js/controller.js:208-225
Configured destinations run only through a user-clicked context-menu item. — js/background.js:358-399
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Uses chrome.tabs.update only to navigate to the requested search result. — js/background.js:43-64
Contains no page-editing code. — js/content-script.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It opens user-configured search URLs containing the selected text. It does not fetch responses, download files or act as a network proxy.
Constructs a URL and passes it to browser tab/window navigation APIs. — js/background.js:36-64,81-97
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no native or system-level permission. — manifest.json:48-49
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
References only local JavaScript files. — options.html:113-126
Contains no fetch, XMLHttpRequest, script injection, eval or Function call. — js/background.js:1-404
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Makes options.html and CSS web-accessible but declares no externally_connectable entry. — manifest.json:37-47
Contains no window-message or runtime-message bridge. — js/content-script.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines the saved behavior and default search-engine list. — js/service.js:10-55
Applies the configured destination and tab/window behavior during a search. — js/background.js:43-134
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Implements only configuration and search navigation. — js/background.js:1-404
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The page content script is empty. — js/content-script.js:1