Is Flashing News & Search safe?

Medium risk

Flashing News & Search replaces the new tab page and routes all searches and news fetches through its own servers using a hardcoded publisher key.

Every time a new tab is opened, the extension automatically fetches news articles from api.news-headlines.co using a fixed publisher token shared across all installs. Search queries typed into the new tab page are redirected to trends.search-hub.co instead of the user's default search engine. The API responses include a per-session identifier, allowing the operator to track browsing sessions across new tab opens.

Breinapps (Oded)v1.0.7Chrome Web Store
45Risk
Who publishes it

Brein Apps LTD - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Breinapps (Oded)
Declared legal entity
Brein Apps LTD
Website
breinapps.com

Same store account

1 other listing published from this account, 63 users between them. 1 of them carries a finding.

News New Tab63Medium

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.news-headlines.co
Also called by 1 other listing: Art New Tabs
trends.search-hub.co
Also called by 1 other listing: Art New Tabs

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab searches redirect to trends.search-hub.co

Searching from the new tab page, the code blocks form submission and redirects the tab to trends.search-hub.co with your query in the URL.

DA observed the submit trigger this navigation; the code shows a hardcoded publisher key in the URL.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You submit a search from the extension's new tab page.

The extension did this

The extension redirects the tab to trends.search-hub.co with your search text in the URL.

The same URL also carries the hardcoded publisher key 8FCC6A3D057104B870B51.

Values placed into the redirected search URL
  • Search text
    weather tomorrow (illustrative)

    This is the query you typed into the new tab search box.

  • Publisher key
    8FCC6A3D057104B870B51

    This ties the search flow to this extension's configured partner identifier.

  • Search URL
    https://trends.search-hub.co/v1/search/8FCC6A3D057104B870B51?q=weather%20tomorrow (illustrative)

    The full URL carries your query to the search provider instead of keeping it in your browser's default search engine.

Captured request
GEThttps://trends.search-hub.co/v1/search/8FCC6A3D057104B870B51?q=weather%20tomorrow
The code that does this

The search form handler constructs the redirect URL

Readable version

Hardcoded endpoints and search base

deobfuscated/newtab.js
const API_URL =  "https://api.news-headlines.co/v1.1/8FCC6A3D057104B870B51/document/get";const FETCH_OPTIONS = {  method: "GET",  mode: "cors",  headers: { Accept: "application/json" }};// Search redirect (as requested)const SEARCH_BASE =  "https://trends.search-hub.co/v1/search/8FCC6A3D057104B870B51?q=";

News-card fallback also uses the same search base

deobfuscated/newtab.js
function pickClick(item) {  const click = item?.clickUrl;  if (typeof click === "string" && click.startsWith("http")) return click;  const orig = item?.originalUrl;  if (typeof orig === "string" && orig.startsWith("http")) return orig;  const title = item?.title || "news";  return `${SEARCH_BASE}${encodeURIComponent(title)}`;}

Submit handler redirects the tab

deobfuscated/newtab.js
searchForm.addEventListener("submit", (e) => {  e.preventDefault();  const q = searchInput.value.trim();  if (!q) return;  window.location.href = SEARCH_BASE + encodeURIComponent(q);});
External services involved in the new tab flow
    • trends.search-hub.co

    Receives new tab search navigations with the typed query and publisher key in the URL.

    • api.news-headlines.co

    Supplies the new tab news feed using the same hardcoded publisher key.

What it can do

Permissions this extension asks for, as declared in version 1.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.news-headlines.co

    https://api.news-headlines.co/* and 1 more

Where it sends data

Destinations our analysis observed Flashing News contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • trends.search-hub.co

    Flashing News sends data to trends.search-hub.co. 2 other extensions we have analysed send data here.

  • api.news-headlines.co

    Flashing News sends data to api.news-headlines.co. One other extension we have analysed sends data here.

Updated 30 September 2026lfijdjniojlgmleehlncblcenajekoic