Is Hustle safe?

Medium risk

Hustle sends each keystroke typed into its new-tab search box to hustletab.io for autocomplete suggestions.

Hustle replaces the browser's new tab page with a search box. As you type a query, every keystroke is forwarded to hustletab.io to fetch live autocomplete suggestions, with no debounce, so partial queries leave the browser one character at a time. When a search is submitted, the query is routed through search.hustletab.io along with a persistent per-user identifier and install-week tracking parameters before the tab is redirected.

hustletab.iov1.0.4Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

New-tab search box sends each keystroke to hustletab.io

Hustle replaces your new-tab page with its own search box.

As you type, it sends the text so far to hustletab.io on every keystroke, with no delay.

Dynamic analysis observed a marker leaving in a request to the vendor's domain.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You type a query into the new-tab search box.

Each character you enter raises an input event on the search field.

The extension did this

The extension sends the text typed so far to hustletab.io to fetch suggestions.

A GET request to hustletab.io/ff/suggest_ch.php carries the partial query in its query string, fired once per keystroke.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://hustletab.io/ff/suggest_ch.php?query=canarysearch123
JSON array of autocomplete suggestion strings rendered below the search box.
03EvidenceCODE COMPARE
The code that does this

The search input handler calls the suggestion fetch on every keystroke

What it actually does
onInput handler reads the field value and calls j(t) on every input eventstatic/js/main.e70cf306.js (~line 34864)
onInput: function (e) {
  var t = e.target.value;
  a(t);   // update the visible input state
  j(t);   // fetch suggestions for the partial query
}
j(t) sends the partial query to hustletab.io and renders the JSON responsestatic/js/main.e70cf306.js (~line 34786)
var j = function (t) {
  // no debounce — fires on each keystroke
  return fetch(
    "https://hustletab.io/ff/suggest_ch.php?query=" + (t != null ? t : "")
  )
  .then(function (r) { return r.json(); })
  .then(function (suggestions) { /* render suggestions */ });
};
04EvidenceFIELD TABLE
What is sent to hustletab.io as you type
FieldValueWhy it matters
Partial search text
query=che (then chea, cheap, cheap+f, ...)The characters you have typed into the new-tab search box so far. Accumulates one character per request until you finish typing.
Destination host
hustletab.ioThe vendor's own first-party domain that receives the partial query and returns suggestions.

Data recipients

hustletab.iosearch.hustletab.io
Updated 17 September 2026jghglmoeijfndmbpajblhkdnchjngpeg