Is Clarity Tab safe?

Low risk

Clarity Tab sends recent bookmark domains to Google's favicon service on its new tab page.

When its new tab page loads, Clarity Tab reads the five most recent bookmarks and extracts each bookmark URL's hostname. It uses those hostnames to request favicon images from www.google.com/s2/favicons, which sends the recent bookmark domains to Google.

claritynewtabv1.3.4.1Chrome Web Store
20Risk
Who publishes it

claritynewtab - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
claritynewtab
Website
brandnewtab.com/clarity-tab/pages/contact.html

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab page sends your recent bookmark domains to Google's favicon service

Every time you open a new tab, the extension reads your five most recent bookmarks and sends each bookmark's domain to Google's favicon service to fetch an icon.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

The extension has replaced Chrome's default new tab page with Clarity-Tab.html.

The extension did this

The extension sends the domain of each of your five most recent bookmarks to Google's favicon service.

This happens automatically, with no bookmark selection or click required.

The code that does this

Bookmark domains are read and forwarded to Google on every new tab

Readable version

Same code, not obfuscated (extension ships readable source)

// Not obfuscated: the shipped code already reads plainly.// getRecent(5) -> new URL(bookmark.url).hostname -> google.com/s2/favicons?domain_url=<hostname>
Captured request
GEThttps://www.google.com/s2/favicons?sz=64&domain_url=example-bookmarked-site.com

Observed during dynamic analysis: after planting a marker bookmark and opening the extension's new tab page, the extension issued a request in this exact form, carrying the planted domain in the domain_url query parameter (domain shown here is illustrative, standing in for the planted marker value).

What Google's favicon service receives
  • Bookmark domain
    docs.google.com

    The hostname of a site you recently bookmarked, sent in plain text in the request URL.

  • Number of domains per session
    5

    Up to five domains, one per recent bookmark, sent every time you open a new tab.

Where your bookmark domains go
    • www.google.com

    Google's favicon lookup service (s2/favicons). Receives the domain_url parameter on every request; Google's own logging and retention practices for this endpoint apply.

What it can do

Permissions this extension asks for, as declared in version 1.3.4.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on unsplash.com

    *://*.unsplash.com/*

  • Read and change your data on api.weatherapi.com

    *://api.weatherapi.com/*

  • Read and change your bookmarks

    bookmarks

Where it sends data

Destinations our analysis observed Clarity Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Clarity Tab sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

Updated 30 September 2026kdgbiianfabnkkmkablnojimjdkhlnbh