Is Apollo Tab safe?

Medium risk

Apollo Tab sends new-tab searches to its own server tagged with a persistent per-install ID instead of your default search engine.

The new tab page's search box does not use your browser's configured search engine. Instead it builds a URL to search.apollotab.com containing your typed query, a UUID generated once at install and stored locally, and a secret token issued by the vendor's install endpoint, then navigates the tab there directly. This means every search performed from the new tab page is logged against a stable identifier that ties it back to your specific installation.

https://apollotab.com/v2.0.4Chrome Web Store
49Risk
Who publishes it

https://apollotab.com/ - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
https://apollotab.com/
Website
apollotab.com/#contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab search sends your queries to apollotab.com with a tracking ID

Code analysis shows the New Tab search box sends your typed query to apollotab.com's own server instead of your browser's default search engine, attaching a persistent per-install ID to every search.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You type a search term into the New Tab page's search box and press Enter.

The extension did this

The extension rewrites your query into a URL for its own search.apollotab.com endpoint and navigates the current tab there.

This replaces the browser's configured default search engine every time, on every New Tab search.

Parameters attached to every search you type
  • Your search text
    q=best noise cancelling headphones

    The exact words you typed are placed in the destination URL's query parameter.

  • Your install ID
    uid=1a2b3c4d-5e6f-4789-90ab-cdef01234567

    A UUID generated once at install and reused on every search, letting the vendor link all your searches to one profile.

  • Server-issued token
    ch=8f3ae21c9b

    A code the vendor's server assigned your install at setup time, sent back with every query.

  • Campaign tag
    utm_uid=aff-4471

    A tracking tag assigned at install, used to attribute your install to whichever channel installed the extension.

  • Browser version
    bv=128

    Your Chrome version number, sent alongside the rest.

The code that does this

startSearch() overriding the search destination

Readable version
function startSearch() {    let query = $("#SearchBar2").val().trim();    if (query.length === 0) {        return;    }    let queryStringObject = {        uid: USER_ID,        rnd: 1,        themeIndex: EXTENSION_CODE,        b: "chrome",        bv: browser_version,        ch: SECRET,        utm_uid: utm_uid,    };    let extra_params = encodeUrlParams(queryStringObject);    let mainUrl = "https://search.apollotab.com/01393763-dee9-4537-885c-85ca417f3e6c?q=" + query + "&" + extra_params;    chrome.search.query({ text: mainUrl, disposition: 'CURRENT_TAB' }, () => {        chrome.tabs.update({ url: mainUrl });    });}
What actually happens
You did this

You install the extension for the first time.

The extension did this

The extension generates a persistent UUID and sends it to apollotab.com, which returns a session token and campaign tag that get saved for reuse on every future search.

Both values persist in chrome.storage.local until the extension is uninstalled.

Where your searches and install identifiers go
    • search.apollotab.com

    Receives every New Tab search query, together with your persistent install ID and token, instead of your default search engine.

    • apollotab.com

    Issues the persistent ID's token and campaign tag at install time via /ch/install.php.

Check if you're affected

Parses a captured search.apollotab.com URL and prints out which of your search text and tracking identifiers it carries.

Requires
  • Node.js 14+
decode_apollotab_url.js · js
// decode_apollotab_url.js// Parses a captured search.apollotab.com URL and prints out which of your// search text and tracking identifiers were attached to it.const target = process.argv[2];if (!target) {  console.error("Usage: node decode_apollotab_url.js '<captured-url>'");  process.exit(1);}const parsed = new URL(target);const params = parsed.searchParams;console.log("Search text (q):      ", params.get("q"));console.log("Persistent install ID:", params.get("uid"));console.log("Server-issued token:  ", params.get("ch"));console.log("Campaign tag:         ", params.get("utm_uid"));console.log("Browser reported:     ", params.get("b"), params.get("bv"));
How to run it
  1. 1Capture the URL your browser navigated to after searching (DevTools Network tab or chrome://net-export).
  2. 2Run node decode_apollotab_url.js '<captured-url>'.
  3. 3Read the printed q, uid, ch, and utm_uid values.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Apollo Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • apollotab.com

    Apollo Tab sends data to apollotab.com. No other extension we have analyzed sends data here.

  • search.apollotab.com

    Apollo Tab sends data to search.apollotab.com. No other extension we have analyzed sends data here.

Updated 30 September 2026kplbkdjlgpifcccnhoobhdmcpjnlogbh