[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

DuckDuckGo Search & Tracker Protection

Version 2025.11.3 View in Chrome Web Store

Last scanned: 2 days ago | force re-scan

Extension Details

Developer: DUCKDUCKGO SUBSCRIPTION INC.

Rating: 4.2 ★ (2.1K ratings)

Users: 3,000,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: DuckDuckGo is a well-established privacy-focused company with a strong reputation for protecting user data. The extension has 3 million users and a solid 4.2-star rating, indicating widespread adoption and general user satisfaction. The company's core business model aligns with privacy protection, making malicious intent unlikely.

Concerns: While the security analysis flags this as "Critical" risk due to extensive permissions, these permissions are actually necessary for the extension's core functionality as a tracker blocker and search tool. The broad host permissions and content script injection capabilities allow it to block trackers across all websites. The webRequest, webNavigation, and cookies permissions enable comprehensive tracker detection and blocking. However, these same permissions could theoretically be misused to monitor browsing activity extensively.

The main concern is the inherent tension between the extension's legitimate need for broad access to perform tracker blocking versus the potential privacy implications of such extensive permissions.

Recommendations: Given DuckDuckGo's strong privacy reputation and the extension's legitimate need for these permissions, the risk is acceptable for most users. However, privacy-conscious users might consider running it in a separate Chrome profile as an extra precaution. Regularly review the extension's privacy policy and monitor for any changes in ownership or behavior. The extension's benefits likely outweigh the risks for users seeking tracker protection.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
alarms
contextMenus
declarativeNetRequest
declarativeNetRequestFeedback
scripting
storage
tabs
webRequest
webNavigation
cookies

Optional Permissions:

browsingData

Host Permissions:

*://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'; frame-ancestors https://duckduckgo.com https://*.duckduckgo.com

Embedded URLs (117 total):

http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://sketchapp.com	https://github.com/duckduckgo/privacy-dashboard
http://www.apache.org/licenses/LICENSE-2.0	https://bugs.chromium.org/p/v8/issues/detail?id=10682
https://bugs.chromium.org/p/chromium/issues/detail?id=950357	https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/select
https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/setSelectionRange	https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/stepDown
https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/stepUp	https://developer.mozilla.org/en-US/docs/Web/HTML/Element/dialog#usage_notes
https://tc39.es/proposal-intl-locale/#sec-Intl.Locale.prototype.language	https://tc39.es/proposal-intl-locale/#sec-Intl.Locale.prototype.script
https://tc39.es/proposal-intl-locale/#sec-Intl.Locale.prototype.region	https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/
https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/#3rd-party-tracker-loading-protection	https://duckduckgo.com/duckduckgo-help-pages/threat-protection/scam-blocker
https://duckduckgo.com/malicious-site-protection/report-error	https://duckduckgo.com/spread
https://duckduckgo.com/email	http://jedwatson.github.io/classnames
https://staticcdn.duckduckgo.com/trackerblocking/lm/tds.json	https://github.com/duckduckgo/privacy-configuration
https://www.youtube.com/watch?v=yKWIA-Pys4c	https://github.com/duckduckgo/privacy-configuration/issues/1058
https://github.com/duckduckgo/privacy-configuration/issues/1365	https://github.com/duckduckgo/privacy-configuration/pull/2821
https://www.facebook.com/help/597429858389632/	https://support.google.com/a/answer/33864
https://www.facebook.com/help/messenger-app/597429858389632/	https://staticcdn.duckduckgo.com/trackerblocking
https://duckduckgo.com/feedback.js?type=extension-feedback	https://duckduckgo.com/smarter_encryption.js
https://webtransparency.cs.princeton.edu/webcensus/	https://staticcdn.duckduckgo.com/https/https-bloom.json
https://staticcdn.duckduckgo.com/https/negative-https-bloom.json	https://staticcdn.duckduckgo.com/https/negative-https-allowlist.json
https://staticcdn.duckduckgo.com/https/https-allowlist.json	https://duckduckgo.com
https://duckduckgo.com/extension-success	https://clients2.google.com/service/update2/crx
https://duckduckgo.com/favicon.ico	https://duckduckgo.com/?q=
https://duckduckgo.com/ac/?q=	http://www.fontspring.com
http://www.fontspring.com/fflicense/mark-simonson-studio	https://tinyurl.com/y2uuvskb
http://bit.ly/2kdckMn	https://html.spec.whatwg.org/#safelisted-scheme
https://html.spec.whatwg.org/#web+-scheme-prefix	https://improving.duckduckgo.com/t/
https://duckduckgo.com/chrome_newtab	https://github.com/emn178/js-sha1
https://duckduckgo.com/atb.js?	https://duckduckgo.com/exti/?
https://mathiasbynens.be/notes/javascript-encoding	https://duckduckgo.github.io/privacy-dashboard/interfaces/Generated_Schema_Definitions.LocaleSettings.html
http://example.com/about	https://www.youtube.com/oembed?format=json
https://youtu.be/	https://quack.duckduckgo.com/api/email/addresses
https://staticcdn.duckduckgo.com/trackerblocking/	https://github.com/hij1nx/EventEmitter2
https://duckduckgo.com/global-privacy-control-learn-more	https://help.duckduckgo.com/duckduckgo-help-pages/privacy/embedded-content-protection/
https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/#the-fire-button	https://duckduckgo.com/email/enable-autofill
http://www.w3.org/XML/1998/namespace	https://github.com/unicode-org/icu/blob/master/icu4c/source/i18n/unicode/unumberformatter.h
https://unicode-org.github.io/icu/userguide/format_parse/numbers/skeletons.html#integer-width	https://www.w3.org/TR/selectors/#lang-pseudo
https://promisesaplus.com/#point-64	https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	https://jquery.com/
https://jquery.org/license	https://github.com/jonschlinkert/is-plain-object
https://github.com/duckduckgo/content-scope-scripts/	https://example.com

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "img/icon_16.png",
    "48": "img/icon_48.png",
    "128": "img/icon_128.png"
  },
  "action": {
    "default_icon": "img/icon_browser_action.png",
    "default_popup": "dashboard/html/browser.html"
  },
  "omnibox": {
    "keyword": "ddg"
  },
  "storage": {
    "managed_schema": "managed-schema.json"
  },
  "version": "2025.11.3",
  "background": {
    "service_worker": "public/js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "activeTab",
    "alarms",
    "contextMenus",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "scripting",
    "storage",
    "tabs",
    "webRequest",
    "webNavigation",
    "cookies"
  ],
  "options_page": "html/options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "public/js/content-scripts/autofill.js"
      ],
      "css": [
        "public/css/autofill-host-styles.css"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "exclude_matches": [
        "*://localhost/*",
        "*://*.localhost/*"
      ],
      "match_about_blank": true,
      "match_origin_as_fallback": true
    },
    {
      "js": [
        "public/js/content-scripts/breakage-stats.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "exclude_matches": [
        "*://localhost/*",
        "*://*.localhost/*"
      ],
      "match_about_blank": true
    }
  ],
  "host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "browsingData"
  ],
  "minimum_chrome_version": "128.0",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'; frame-ancestors https://duckduckgo.com https://*.duckduckgo.com"
  },
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "smarter_encryption",
        "path": "data/bundled/smarter-encryption-rules.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "/web_accessible_resources/*",
        "/img/logo-small-grayscale.svg",
        "/public/css/autofill.css",
        "/html/tracker-stats.html"
      ],
      "use_dynamic_url": true
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "/public/font/*",
        "/img/logo-small.svg"
      ],
      "use_dynamic_url": false
    }
  ],
  "chrome_settings_overrides": {
    "search_provider": {
      "name": "DuckDuckGo",
      "keyword": "duckduckgo.com",
      "encoding": "UTF-8",
      "is_default": true,
      "search_url": "https://duckduckgo.com/?q={searchTerms}",
      "favicon_url": "https://duckduckgo.com/favicon.ico",
      "suggest_url": "https://duckduckgo.com/ac/?q={searchTerms}&type=list",
      "prepopulated_id": 92
    }
  }
}

by ✦ Astarte

DuckDuckGo Search & Tracker Protection

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (117 total):

Raw Manifest

Detections

Manifest Findings