Is Dashlinks - New Tab safe?

Medium risk

Dashlinks - New Tab replaces the browser's new tab page and sends every search query to search4it.net along with the extension ID and version.

When a user types a search in the new tab page, the extension redirects the query to search4it.net/search.php, appending the extension's version and internal Chrome runtime ID to the request. This means the operator can track which users are running which version of the extension through their search activity.

Dashlinksv1.0.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab searches go to search4it.net with extension metadata

MediumunwantedCWE-359Dynamic sandbox

Submitting a search from the Dashlinks new tab redirects to search4it.net, carrying the search text, the extension ID, and version 1.0.2, so the provider gets both the query and the extension identifier.

What actually happens

You did this

You submit a search from the extension's new tab page.

The manifest makes index.html the Chrome new tab page, and that page contains a search form.

The extension did this

The extension redirects the browser to search4it.net with your query and extension metadata in the URL.

The submit handler reads the search box, reads the extension version, and appends chrome.runtime.id before navigating.

Query-string fields sent to search4it.net

  • Your search text
    weather tomorrow

    This is the text you typed into the new tab search box.

  • Extension ID
    gfkcocmdmegcelbkamlglehhomiahgjm

    This identifies the installed Chrome extension that sent the request.

  • Extension version
    1.0.2

    This shows which release of the extension produced the request.

Captured request

GEThttps://search4it.net/search.php?v=1.0.2&id=gfkcocmdmegcelbkamlglehhomiahgjm&q=weather%20tomorrow

Browser navigation request; no request body is used for this GET.

The code that does this

The new tab search submit handler constructs the redirect URL

Readable version

Manifest new tab override

manifest.json
{"update_url": "https://clients2.google.com/service/update2/crx",  "background": {    "service_worker": "service_worker.js"  },  "chrome_url_overrides": {    "newtab": "index.html"  },  "default_locale": "en",  "description": "__MSG_appDesc__",  "icons": {    "128": "128.png"  },  "manifest_version": 3,  "name": "__MSG_appName__",  "permissions": [    "storage",    "topSites"  ],  "version": "1.0.2",  "web_accessible_resources": [    {      "resources": [        "128.png"      ],      "matches": [        "<all_urls>"      ]    }  ],  "action": {    "default_icon": "128.png"  }}

Search form markup

index.html
<div class="search_container">  <form class="search">    <input type="text" class="main"/><span class="searchicon"></span>  </form></div>

Search submit handler

index.js
function searchListener() {    document.querySelector('form.search').addEventListener('submit', function (el) {        console.log(el);        el.preventDefault();        var manifestData = chrome.runtime.getManifest();        window.location.href= "https://search4it.net/search.php?v="+encodeURIComponent(manifestData.version)+"&id="+encodeURIComponent(chrome.runtime.id)+"&q="+encodeURIComponent(document.querySelector('input.main').value);    });}

External host receiving the search redirect

    • search4it.net

    Receives the new tab search request with q, id, and v query parameters.

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Read the sites you visit most

    topSites

Where it sends data

Destinations our analysis observed Dashlinks - New Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • search4it.net

    Dashlinks - New Tab sends data to search4it.net. No other extension we have analyzed sends data here.

Updated 30 September 2026gfkcocmdmegcelbkamlglehhomiahgjm