Who makes Infinity New Tab?

Infinity New Tab is published by Infinity Teams. The same operator publishes 2 other store listings, 1 of which carry a security finding.

Is Infinity New Tab safe?

Clean risk

Infinity New Tab is rated clean, though our review noted the following. Infinity New Tab ships default shortcuts for brands like Booking, Amazon, eBay, AliExpress, Spotify, Walmart, Microsoft, TurboTax and Samsung, routed through affiliate/redirect networks, per the bundled shortcut list and click…

Infinity Teamsv11.0.43Chrome Web Store

3Risk

Who publishes it

Infinity Teams - 2 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Infinity Teams

Website

www.infinitytab.link/privacy/en/privacy

Same store account

2 other listings published from this account, 500k+ users between them. 1 of them carries a finding.

Infinity New Tab300k+Medium WeTab200k+Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

static.wetab.link

Also called by 3 other listings, including HiTab - New Tab Dashboard and Widgets

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Default shortcuts route clicks through affiliate networks

MediumunwantedCWE-359Dynamic sandbox

Infinity New Tab ships default shortcuts for brands like Booking, Amazon, eBay, AliExpress, Spotify, Walmart, Microsoft, TurboTax and Samsung, routed through affiliate/redirect networks, per the bundled shortcut list and click handler.

What actually happens

You did this

You click a branded shortcut that is already present on the new-tab page.

Examples in the bundled default list include Booking, Amazon, eBay, AliExpress, Spotify, Walmart, Microsoft, TurboTax, and Samsung.

The extension did this

The extension opens the shortcut’s saved affiliate or redirect URL instead of a direct homepage URL.

That URL can send the click through an affiliate host before the final brand page loads.

Concrete fields in the bundled shortcut records

Shortcut label
Amazon
This is the brand name you see on the new-tab shortcut.
Opened destination
https://sovrn.co/11h5wnr
This is the URL your browser is sent to when you choose the shortcut.
Affiliate campaign value
campid=5339103610&customid=infinity
This can associate the click with a publisher or campaign before the brand site opens.
Final brand URL inside a redirect
u=https%3A%2F%2Fwww.walmart.com%2F
Some redirect URLs include the brand destination as an encoded parameter.

Captured request

GEThttps://sovrn.co/11h5wnr

No live response was captured because the default shortcut grid did not render during dynamic analysis.

The code that does this

Bundled shortcut entries and the click-to-navigation sink

Readable version

Show shipped source

Readable default shortcut records

deobfuscated/7.js

default: [{  uuid: "080772d54828d47e7f8ce223c66f36df",  name: "Booking",  target: "https://www.booking.com/index.html?aid=1267011",  bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/83e58c13ed40dc8393297d43d2639cce.png",  bgType: "image",  type: "web"}, {  uuid: "4299970b2e054e9a39450e6f854a684c",  name: "Amazon",  target: "https://sovrn.co/11h5wnr",  bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/e67eed044bf08fbcac16a0527fcc165a.png",  bgType: "image",  type: "web"}, {  uuid: "912ed4e109a1cde4b956fa8a1670fae2",  name: "eBay",  target: "https://www.ebay.com/?mkcid=1&mkrid=711-53200-19255-0&siteid=0&campid=5339103610&customid=infinity&toolid=10001&mkevt=1",  bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/ebay.png",  bgType: "image",  type: "web"}, {  name: "AliExpress",  uuid: "c4cbd39c0ff571475f3f4d09df79426c",  bgType: "image",  bgImage: "https://infinityicon.infinitynewtab.com/icon/07ec46eac62dca559954f3c21736b5c0.png",  target: "http://s.click.aliexpress.com/e/jy3RvNn",  type: "web"}, {  name: "Spotify",  uuid: "f91b1d1670595c8e7a5459fcc32ad0d4",  bgType: "image",  bgImage: "https://infinityicon.infinitynewtab.com/icon/a0fdd81b4dda32d7394a9151f6d274ef.png",  target: "https://sovrn.co/19egzal",  type: "web"}, {  name: "Walmart",  uuid: "778bb326cdf44093d702f6f016754cec",  bgType: "image",  bgImage: "https://infinityicon.infinitynewtab.com/icon/150127100751.png",  target: "https://redirect.viglink.com?key=ddac7c192269498283581986ec8a9aaa&u=https%3A%2F%2Fwww.walmart.com%2F",  type: "web"}, {  name: "Microsoft",  uuid: "cbad4a1402d12a5574cabf9c0cc10634",  bgType: "image",  bgImage: "https://infinityicon.infinitynewtab.com/icon/150127092730.png",  target: "https://sovrn.co/3to9uma",  type: "web"}, {  name: "Turbotax",  uuid: "b170651fde3c3b89289c588266c582a3",  bgType: "image",  bgImage: "https://infinityicon.infinitynewtab.com/icon/b170651fde3c3b89289c588266c582a3.png",  target: "https://sovrn.co/9mrq11x",  type: "web"}, {  name: "Samsung",  uuid: "4f7ffdfa59a5879cba9bfd41e8b5b9f6",  bgType: "image",  bgImage: "https://infinityicon.infinitynewtab.com/icon/ea07e21040037300243e520d89e0e818.png",  target: "https://sovrn.co/15mhkmf",  type: "web"}]

Readable URL-opening helper

deobfuscated/newtab/newtab.js

openUrl: (t, e = !0, n) => {  !n || 1 !== n.button && !f.ctrlKeyStatus(n) ? e ? o.s ? window.open(t, "_blank").focus() : window.chrome.tabs.create({    url: t,    active: !0  }) : l(t) : o.s ? window.open(t, "_blank") : window.chrome.tabs.create({    url: t,    active: !1  })}

Readable shortcut click path

deobfuscated/14.js

this._handleClick = t => {  if (this.menu.toHide(), this.icon.children) B.changeFolderFlipData({}), B.openFolderWithIndexs(this.indexs), A.a.sendEvent({ action: "openFolder" });  else {    const e = this.icon;    if (B.iconEditing) {      if (e.target === K.j.target) return;      l.siteStore.setEditSite(e.id), l.pluginStore.show("editIcon"), A.a.sendEvent({ action: { openEditicon: c.a.getTargetLogDomain(e.target) } });    } else {      if (A.a.sendEvent({ action: { openIcon: c.a.getTargetLogDomain(e.target) } }), lt(e.target)) return;      const { link: i } = l.settingStore.setting;      if (e.target.startsWith("chrome-app://")) return void c.a.openChromeApp(e.target.split("chrome-app://")[1], i.icon, t);      if (e.target.startsWith("infinity://")) return o.h && "infinity://history" === e.target ? void c.a.openUrl("chrome://history/", i.icon, t) : "infinity://gmail" === e.target ? void c.a.openUrl("https://mail.google.com/mail/ca", i.icon, t) : (l.pluginStore.show(e.target), void A.a.sendEvent({ action: { openApp: e.target } }));      c.a.openUrl(e.target, i.icon, t);    }  }}

Affiliate and redirect hosts present in default shortcuts

- sovrn.co
Receives default shortcuts for Amazon, Spotify, Microsoft, TurboTax, Samsung, and additional brand entries in the bundled list.
- redirect.viglink.com
Receives default shortcuts such as Walmart and TripAdvisor with a key parameter and encoded destination URL.
- www.ebay.com
Receives the eBay shortcut with eBay Partner Network parameters including campid=5339103610 and customid=infinity.
- www.booking.com
Receives the Booking shortcut with the affiliate aid=1267011 parameter.
- s.click.aliexpress.com
Receives the AliExpress shortcut through an AliExpress affiliate click URL.
- c.duomai.com
Receives Chinese-locale shopping shortcuts with aid, euid=infinity, and encoded destination parameters.
- click.union.vip.com
Receives a Chinese-locale VIP shortcut through an encoded union redirect URL.

Traffic caveat

Across three dynamic-analysis attempts, the new-tab page loaded but the default shortcut grid did not populate; the <newtab-topsite> area stayed empty behind a permission modal, so no live click-through request to these affiliate hosts was captured. The confirmation rests on the bundled shortcut list and the click handler that opens each saved target.

What it can do

Permissions this extension asks for, as declared in version 11.0.41. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 11.0.43, which we have not unpacked yet.

Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Run hidden pages in the background
offscreen
Keep running in the background while your browser is open
background