Is Bonjourr · Minimalist New Tab Page safe?

Medium risk

Bonjourr sends shortcut link origins, sync URLs, and custom background URLs to its own proxy service when direct requests fail.

On every new tab load, Bonjourr transmits the origin of each user-added shortcut link to services.bonjourr.fr to fetch favicons. When a user-configured sync URL or custom background URL cannot be fetched directly (e.g. due to CORS restrictions), the extension silently forwards those full URLs to Bonjourr's proxy server without notifying the user.

Victor Azevedov22.3.0Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-319
SourceAI SANDBOX

Private sync URL is sent to Bonjourr proxy after sync fallback

When Bonjourr's URL sync direct request fails, the extension sends the full sync URL to Bonjourr's proxy service.

This can expose a user-configured private sync URL to services.bonjourr.fr/proxy during setup and later syncs.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user configures URL sync or triggers a sync-down operation.

The extension did this

If the direct sync fetch fails, the extension posts the full configured URL to Bonjourr's proxy.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://services.bonjourr.fr/proxy
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Your sync URL
https://example.com/private/bonjourr-sync.json (illustrative)This is the user-configured URL used for Bonjourr sync; it may identify a private storage location or include sensitive path/query details.
04EvidencePLAIN NOTE
Observation

Dynamic analysis confirmed the fallback path: after a direct fetch failure, Bonjourr posted the configured sync URL to its proxy service.

Data recipients

services.bonjourr.fr
Updated 17 September 2026amo-2269040