Is i芒果・新标签页 safe?

High risk

i芒果・新标签页 sends the URL of every tab you visit to mgtv.com servers, paired with a persistent device fingerprint.

On every completed tab navigation, the extension transmits the full URL along with a device identifier, session ID, and screen resolution to pcweb-v1.log.mgtv.com, creating a continuous browsing history log. The device identifier is generated using canvas and WebGL rendering fingerprints and persisted across sessions, allowing mgtv.com to track activity over time. If the user is signed into an MGTV account, their UUID and VIP subscription status are also included in each beacon, linking browsing activity to an authenticated identity.

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Every page you visit is reported to a Mango TV logging server

Every time a tab finishes loading, this new-tab extension sends the page URL to pcweb-v1.log.mgtv.com with a device ID, session ID, and screen resolution.

Host permission is *.mgtv.com, but 'tabs' reads any URL.

One beacon fires per page.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open or navigate to any web page, any site, anywhere.

The extension did this

The extension reads the page URL and sends it to pcweb-v1.log.mgtv.com together with a device ID and session ID.

No interaction with the new-tab page is required. The listener fires on every navigation, not only on mgtv.com pages.

02EvidenceFIELD TABLE
What is sent on every page you visit:
FieldValueWhy it matters
The URL you are visiting
https://chatgpt.com/The exact page you are on, including any path and query parameters in the URL.
Device ID
aef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146A persistent identifier for your install. Lets every reported page be tied back to the same device over time.
Session ID
mba_sessionid-7f21ac90Groups the pages from one browsing session together.
Open type
1Whether the page opened in a brand-new tab or in an existing one.
Screen resolution
1920*1080Your display width and height, part of a device profile.
Report context
cntp=imango_background, mod=open_new_tag_page, logtype=clickHardcoded labels identifying this as a background page-open event. Same for all users.
Extension version
1.0.5Which version of the extension you have installed.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://pcweb-v1.log.mgtv.com/dispatcher.do?did=imango_home&sessionid=mba_sessionid-7f21ac90&url=https%3A%2F%2Fchatgpt.com%2F&cntp=imango_background&ver=1.0.5&time=20260615120730&termid=2&logtype=click&pix=1920*1080&mod=open_new_tag_page&lob=x_device_id%3Daef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146%26sdk_did%3D...
04EvidenceCODE COMPARE
The code that does this

The navigation listener and the reporter, from the shipped service worker.

What it actually does
The navigation listener
// Fires every time any tab finishes loading a page.
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo) => {
  if (!tabId || !changeInfo || changeInfo.status !== 'complete') return;
  const tab = await getTab(tabId);
  // Skip only the new-tab/about pages and the extension's own pages.
  if (!tab || isNewTabUrl(tab.url) || tab.url?.startsWith(chrome.runtime.getURL(''))) return;
  // Every other URL — any website — is reported.
  if (openedTabs.has(tabId)) { openedTabs.delete(tabId); await report(tab.url, 2); }
  else { await report(tab.url, 1); }
});
The reporter that sends the URL
// Sends the visited URL to the logging server.
async function report(url, openType) {
  stat.send('click',
    { ver_type: 'plugin', url: url, open_type: openType },
    { cntp: 'imango_background', mod: 'open_new_tag_page' });
}
05EvidenceTHIRD PARTY LIST
Where your browsing data is sent:
  • pcweb-v1.log.mgtv.com

    Logging endpoint operated by Mango TV (Hunan Mango Excellent Media / mgtv.com). Receives one beacon per page navigation containing the visited URL and device identifiers.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Canvas/WebGL fingerprint builds a persistent device ID sent in every beacon

On first use, the extension renders an off-screen canvas and reads GPU vendor/renderer via WebGL, combined with browser properties into a SHA-256 hash, stored as 'X_DEVICE_ID', attached to every beacon; unchanged across 24 requests.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The extension runs for the first time after install (or after the stored ID is absent).

The extension did this

It builds a device fingerprint from canvas, WebGL GPU info and browser properties, hashes it, and stores the result as a persistent X_DEVICE_ID.

Once stored, the same ID is reused and attached to every later beacon, so all reported activity can be tied to one device.

02EvidenceFIELD TABLE
Signals combined into the device fingerprint:
FieldValueWhy it matters
Canvas rendering
data:image/png;base64,iVBORw0KGgoAAAANSUhEUg...An off-screen canvas image is drawn and read back as a data URL. Small rendering differences between devices make this a per-device signal.
GPU vendor + renderer
Google Inc. (Intel)~ANGLE (Intel, Intel(R) UHD Graphics)Your graphics card vendor and model, read via WebGL debug info.
Browser properties
Mozilla/5.0 ...||en-US||Win32||8||8||1920x1080||24||-60User agent, language, platform, CPU core count, device memory, screen size, color depth and timezone offset.
Resulting X_DEVICE_ID
aef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146The SHA-256 hash of all of the above. Stored and reused as your persistent device identifier.
03EvidenceSTORAGE DUMP
What's stored on your device

The SHA-256 device fingerprint written on first run, read back on every beacon and never regenerated; constant for the life of the install.

Locationchrome.storage.local key 'X_DEVICE_ID'
Contents
X_DEVICE_ID = aef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146
04EvidenceCODE COMPARE
The code that does this

Fingerprint generation and persistence, from the shipped service worker.

What it actually does
Canvas fingerprint
// Draws an off-screen canvas and reads it back as a fingerprint signal.
function canvasFingerprint() {
  const c = document.createElement('canvas');
  const ctx = c.getContext('2d');
  ctx.textBaseline = 'top';
  ctx.font = '14px Arial';
  ctx.fillStyle = '#f60'; ctx.fillRect(125, 1, 62, 20);
  ctx.fillStyle = '#069'; ctx.fillText('device-fingerprint', 2, 15);
  ctx.fillStyle = 'rgba(102,204,0,0.7)'; ctx.fillText('device-fingerprint', 4, 17);
  return c.toDataURL();   // per-device rendering signal
}
Combine + hash into the device ID
// Combines all signals and hashes them into the device ID.
async function makeDeviceId() {
  const input = [Date.now(), browserProps(), canvasFingerprint(), webglFingerprint()].join('###');
  return SHA256(input).toString();   // stored as X_DEVICE_ID, then reused forever
}
05EvidenceTHIRD PARTY LIST
Where the device ID is sent:
  • pcweb-v1.log.mgtv.com

    Logging endpoint operated by Mango TV (mgtv.com). Receives the x_device_id fingerprint on every telemetry beacon, allowing all reported activity to be linked to one install.

Data recipients

pcweb-v1.log.mgtv.com
Updated 17 September 2026ehgkfpmhgeanfegbpfbllhoeamicepjf