Is Good Tab safe?

Critical risk

Good Tab is critical risk. On every new tab, Good Tab loads its UI, including JS, from api.office123456.com over unencrypted HTTP. The extension has almost no code of its own; an iframe is the sole content. A remote server can change that code any time, unverifiably.…

v1.0.5Chrome Web Store
96Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Entire New Tab Page Loaded from Remote HTTP Server

On every new tab, Good Tab loads its UI, including JS, from api.office123456.com over unencrypted HTTP.

The extension has almost no code of its own; an iframe is the sole content.

A remote server can change that code any time, unverifiably.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open a new tab.

The extension did this

Good Tab loads the entire new tab page UI from a remote HTTP server.

Chrome requests http://api.office123456.com/vcx/ inside a full-screen iframe. All application logic, including any JavaScript that can read your clipboard or interact with the page, is fetched from that server.

The code that does this

The entire new tab page is a single iframe pointing to the remote server.

Readable version
<!-- The whole new-tab UI — every button, search box, weather widget,     and its JavaScript — is fetched from this remote URL on every tab open.     The 'allow' attribute grants the remote page clipboard read/write access.     Because the URL uses http://, not https://, the content travels     over an unencrypted connection. -->
Captured request
GEThttp://api.office123456.com/vcx/

HTTP 200, full GoodTab HTML application returned, including script tags loading index.min.js (431KB), web-browser.js, and CSS assets. No redirect to HTTPS.

Where your new tab experience is actually hosted
    • api.office123456.com

    Primary remote server. Serves the entire new tab UI, all JavaScript, and API requests (api/vsion, api/top, api/default). Domain ownership is not disclosed in the extension listing.

Check if you're affected

Checks whether the Good Tab remote server is live and confirms the HTTP (not HTTPS) connection. Run this to verify the remote dependency independently.

Requires
  • bash
  • curl
goodtab-remote-host-check.sh · sh
#!/usr/bin/env bash# goodtab-remote-host-check.sh# Verifies the Good Tab remote iframe server is active and uses plain HTTP.BASE_URL="http://api.office123456.com/vcx/"echo "=== Checking Good Tab remote server ==="echo "URL: $BASE_URL"echo ""# Check HTTP response and follow redirectsHTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$BASE_URL")REDIRECT=$(curl -s -o /dev/null -w "%{redirect_url}" --max-time 10 "$BASE_URL")echo "HTTP status: $HTTP_STATUS"echo "Redirect URL: ${REDIRECT:-none}"if [ "$HTTP_STATUS" = "200" ] && [ -z "$REDIRECT" ]; then  echo ""  echo "CONFIRMED: Server is live and serving over plain HTTP (no HTTPS redirect)."else  echo ""  echo "Server returned status $HTTP_STATUS with redirect: $REDIRECT"fi# Fetch and check first 200 chars of responseecho ""echo "=== Response snippet ==="curl -s --max-time 10 "$BASE_URL" | head -c 200echo ""
How to run it
  1. 1Open a terminal.
  2. 2Run: bash goodtab-remote-host-check.sh.
  3. 3A '200' status with no redirect confirms the remote server is live and uses plain HTTP.

Baidu Analytics Fires on Every New Tab Open

On every new tab, Good Tab's remote page injects a Baidu tracker beaconing hm.baidu.com with your screen resolution, language, a persistent ID (HMACCOUNT), and timestamp.

DA saw this fire three times; undisclosed, no privacy policy link.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new tab.

The extension did this

The remote new tab page injects Baidu Analytics and a tracking beacon is sent to hm.baidu.com.

The beacon carries a persistent device identifier (HMACCOUNT), your screen size, browser language, and viewport dimensions. It fires on every new tab open and is not mentioned in the extension's store listing.

Captured request
GEThttps://hm.baidu.com/hm.gif?hca=4B149AB63AFCB1AF&cc=0&ck=1&cl=30-bit&ds=1512x982&vl=0&et=0&ja=0&ln=en-gb&lo=0&rnd=256085081&si=48948d99e3fbfd4240535b9c39366158

HTTP 200, 1×1 tracking pixel returned by Baidu. Observed 3 times across 3 new tab opens.

What Baidu receives on every new tab open
  • Your device tracking ID
    4B149AB63AFCB1AF

    A persistent ID (HMACCOUNT) tied to your device. Baidu uses this to recognize you across new tab opens, even after browser restarts.

  • Your screen resolution
    1512x982

    The pixel dimensions of your display. Combined with other fields, contributes to browser fingerprinting.

  • Your browser language
    en-gb

    Your browser's configured language setting.

  • Analytics site ID
    48948d99e3fbfd4240535b9c39366158

    Identifies this installation to Baidu's analytics platform.

Where tracking data is sent
    • hm.baidu.com

    Baidu Analytics (Baidu, Inc., China). Receives fingerprint and new-tab events via a 1x1 pixel beacon. HMACCOUNT is set as a persistent cookie, enabling cross-session correlation.

Updated 21 September 2026glckmpfajbjppappjlnhhlofhdhlcgaj