Is i芒果・新标签页 safe?
i芒果・新标签页 sends the URL of every tab you visit to mgtv.com servers, paired with a persistent device fingerprint.
On every completed tab navigation, the extension transmits the full URL along with a device identifier, session ID, and screen resolution to pcweb-v1.log.mgtv.com, creating a continuous browsing history log. The device identifier is generated using canvas and WebGL rendering fingerprints and persisted across sessions, allowing mgtv.com to track activity over time. If the user is signed into an MGTV account, their UUID and VIP subscription status are also included in each beacon, linking browsing activity to an authenticated identity.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every page you visit is reported to a Mango TV logging server
Every time a tab finishes loading, this new-tab extension sends the page URL to pcweb-v1.log.mgtv.com with a device ID, session ID, and screen resolution.
Host permission is *.mgtv.com, but 'tabs' reads any URL.
One beacon fires per page.
What actually happens
You open or navigate to any web page, any site, anywhere.
The extension reads the page URL and sends it to pcweb-v1.log.mgtv.com together with a device ID and session ID.
No interaction with the new-tab page is required. The listener fires on every navigation, not only on mgtv.com pages.
What is sent on every page you visit
- The URL you are visitinghttps://chatgpt.com/
The exact page you are on, including any path and query parameters in the URL.
- Device IDaef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146
A persistent identifier for your install. Lets every reported page be tied back to the same device over time.
- Session IDmba_sessionid-7f21ac90
Groups the pages from one browsing session together.
- Open type1
Whether the page opened in a brand-new tab or in an existing one.
- Screen resolution1920*1080
Your display width and height, part of a device profile.
- Report contextcntp=imango_background, mod=open_new_tag_page, logtype=click
Hardcoded labels identifying this as a background page-open event. Same for all users.
- Extension version1.0.5
Which version of the extension you have installed.
Captured request
The code that does this
The navigation listener and the reporter, from the shipped service worker.
The navigation listener
// Fires every time any tab finishes loading a page.chrome.tabs.onUpdated.addListener(async (tabId, changeInfo) => { if (!tabId || !changeInfo || changeInfo.status !== 'complete') return; const tab = await getTab(tabId); // Skip only the new-tab/about pages and the extension's own pages. if (!tab || isNewTabUrl(tab.url) || tab.url?.startsWith(chrome.runtime.getURL(''))) return; // Every other URL — any website — is reported. if (openedTabs.has(tabId)) { openedTabs.delete(tabId); await report(tab.url, 2); } else { await report(tab.url, 1); }});The reporter that sends the URL
// Sends the visited URL to the logging server.async function report(url, openType) { stat.send('click', { ver_type: 'plugin', url: url, open_type: openType }, { cntp: 'imango_background', mod: 'open_new_tag_page' });}Where your browsing data is sent
- pcweb-v1.log.mgtv.com
Logging endpoint operated by Mango TV (Hunan Mango Excellent Media / mgtv.com). Receives one beacon per page navigation containing the visited URL and device identifiers.
Canvas/WebGL fingerprint builds a persistent device ID sent in every beacon
On first use, the extension renders an off-screen canvas and reads GPU vendor/renderer via WebGL, combined with browser properties into a SHA-256 hash, stored as 'X_DEVICE_ID', attached to every beacon; unchanged across 24 requests.
What actually happens
The extension runs for the first time after install (or after the stored ID is absent).
It builds a device fingerprint from canvas, WebGL GPU info and browser properties, hashes it, and stores the result as a persistent X_DEVICE_ID.
Once stored, the same ID is reused and attached to every later beacon, so all reported activity can be tied to one device.
Signals combined into the device fingerprint
- Canvas renderingdata:image/png;base64,iVBORw0KGgoAAAANSUhEUg...
An off-screen canvas image is drawn and read back as a data URL. Small rendering differences between devices make this a per-device signal.
- GPU vendor + rendererGoogle Inc. (Intel)~ANGLE (Intel, Intel(R) UHD Graphics)
Your graphics card vendor and model, read via WebGL debug info.
- Browser propertiesMozilla/5.0 ...||en-US||Win32||8||8||1920x1080||24||-60
User agent, language, platform, CPU core count, device memory, screen size, color depth and timezone offset.
- Resulting X_DEVICE_IDaef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146
The SHA-256 hash of all of the above. Stored and reused as your persistent device identifier.
What's stored on your device
The SHA-256 device fingerprint written on first run, read back on every beacon and never regenerated; constant for the life of the install.
- Location
- chrome.storage.local key 'X_DEVICE_ID'
X_DEVICE_ID = aef24c2364078db6da0e0a6aa633b1f2559865f8363207a1124b2ec1f4f45146The code that does this
Fingerprint generation and persistence, from the shipped service worker.
Canvas fingerprint
// Draws an off-screen canvas and reads it back as a fingerprint signal.function canvasFingerprint() { const c = document.createElement('canvas'); const ctx = c.getContext('2d'); ctx.textBaseline = 'top'; ctx.font = '14px Arial'; ctx.fillStyle = '#f60'; ctx.fillRect(125, 1, 62, 20); ctx.fillStyle = '#069'; ctx.fillText('device-fingerprint', 2, 15); ctx.fillStyle = 'rgba(102,204,0,0.7)'; ctx.fillText('device-fingerprint', 4, 17); return c.toDataURL(); // per-device rendering signal}Combine + hash into the device ID
// Combines all signals and hashes them into the device ID.async function makeDeviceId() { const input = [Date.now(), browserProps(), canvasFingerprint(), webglFingerprint()].join('###'); return SHA256(input).toString(); // stored as X_DEVICE_ID, then reused forever}Where the device ID is sent
- pcweb-v1.log.mgtv.com
Logging endpoint operated by Mango TV (mgtv.com). Receives the x_device_id fingerprint on every telemetry beacon, allowing all reported activity to be linked to one install.
Where it sends data
Destinations our analysis observed i芒果新标签 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- pcweb-v1.log.mgtv.com
i芒果新标签 sends data to pcweb-v1.log.mgtv.com. One other extension we have analyzed sends data here.