Who makes Infinity New Tab?

Infinity New Tab is published by Infinity Teams. The same operator publishes 2 other store listings, none of which carry a security finding.

Is Infinity New Tab (Pro) safe?

Q: Is Infinity New Tab safe?

Infinity New Tab is medium risk. The new-tab grid's default shortcuts are affiliate redirects, not homepages: Amazon via `sovrn.co/11h5wnr`, Walmart via `redirect.viglink.com`, eBay with Partner attribution. The eBay shortcut was seen loading; no Amazon/Walmart click seen.

Medium risk

Replaces the New Tab page with a customizable dashboard for shortcuts, bookmarks, widgets, and appearance settings.

This extension lets you add, edit, reorder, and remove New Tab shortcuts, including optional partner shortcuts that can be deleted or replaced. It can show bookmarks and frequently visited sites, customize wallpaper and layout, and provide weather, to-do, notes, optional Gmail unread badges, and optional sync or backup through sign-in providers.

Infinity Teamsv11.0.41Chrome Web Store

45Risk

Who publishes it

Infinity Teams - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Infinity Teams

Website

www.infinitytab.link/privacy/en/privacy

Same store account

2 other listings published from this account, 600k+ users between them, none of them carrying a finding.

Infinity New Tab400k+Clean WeTab200k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM

ClassUNWANTED

TypeUnexpected

CWECWE-359

SourceAI SANDBOX

Shopping Shortcuts Route Through Affiliate Links

The new-tab grid's default shortcuts are affiliate redirects, not homepages: Amazon via `sovrn.co/11h5wnr`, Walmart via `redirect.viglink.com`, eBay with Partner attribution.

The eBay shortcut was seen loading; no Amazon/Walmart click seen.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You click a default shopping shortcut on the extension's new tab page.

The tile appears as a normal retailer shortcut in the grid.

The extension did this

The extension opens the URL stored for that tile.

For the Amazon and Walmart defaults, those stored URLs are affiliate redirect URLs rather than direct retailer homepages.

02EvidenceFIELD TABLE

Default shopping shortcut targets in the shipped extension

Field	Value	Why it matters
Amazon shortcut target	https://sovrn.co/11h5wnr	Shows that clicking the Amazon tile starts at an affiliate redirect service instead of directly opening Amazon.
Walmart shortcut target	https://redirect.viglink.com?key=ddac7c192269498283581986ec8a9aaa&u=https%3A%2F%2Fwww.walmart.com%2F	Shows that the Walmart tile includes the retailer URL inside a VigLink redirect URL.
eBay shortcut target	https://www.ebay.com/?mkcid=1&mkrid=711-53200-19255-0&siteid=0&campid=5339103610&customid=infinity&toolid=10001&mkevt=1	Shows that the eBay tile opens the retailer with partner-network attribution parameters in the URL.

03EvidenceNETWORK CAPTURE

Captured request

GEThttps://infinityicon.infinitynewtab.com/user-share-icon/ebay.png

Observed during dynamic analysis when the new tab shortcut grid rendered; no request body was present.

04EvidenceCODE COMPARE

The code that does this

Default shortcut targets and click path

What it actually does

Show shipped source

Readable default shortcut entriesdeobfuscated/7.js

            uuid: "4299970b2e054e9a39450e6f854a684c",
            name: "Amazon",
            target: "https://sovrn.co/11h5wnr",
            bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/e67eed044bf08fbcac16a0527fcc165a.png",
            bgType: "image",
            type: "web"
          }, {
            uuid: "912ed4e109a1cde4b956fa8a1670fae2",
            name: "eBay",
            target: "https://www.ebay.com/?mkcid=1&mkrid=711-53200-19255-0&siteid=0&campid=5339103610&customid=infinity&toolid=10001&mkevt=1",
            bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/ebay.png",
            bgType: "image",
            type: "web"
          }, {
            name: "Youtube",
            uuid: "60e546111669c1d829f962c8831a0926",
            bgType: "image",
            bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/37d396f9975e494b10ac8696d64ebb2a.png",
            type: "web",
            target: "https://youtube.com"
          }, {
            name: "Gmail",
            uuid: "01d0a35ebb602dde4dadd63887cc2a91",
            bgType: "image",
            bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/gmail_2.png",
            type: "app",
            target: "infinity://gmail"
          }, {
            name: "AliExpress",
            uuid: "c4cbd39c0ff571475f3f4d09df79426c",
            bgType: "image",
            bgImage: "https://infinityicon.infinitynewtab.com/icon/07ec46eac62dca559954f3c21736b5c0.png",
            target: "http://s.click.aliexpress.com/e/jy3RvNn",
            type: "web"
          }, {
            name: "Settings",
            uuid: "552fa3a378b29375843fa3d021cbe129",
            bgType: "image",
            bgImage: "https://infinityicon.infinitynewtab.com/user-share-icon/9622b98e90dd4f107d23481566095b34.png",
            type: "app",
            target: "infinity://settings"
          }, {
            name: "Spotify",
            uuid: "f91b1d1670595c8e7a5459fcc32ad0d4",
            bgType: "image",
            bgImage: "https://infinityicon.infinitynewtab.com/icon/a0fdd81b4dda32d7394a9151f6d274ef.png",
            target: "https://sovrn.co/19egzal",
            type: "web"
          }, {
            name: "Walmart",
            uuid: "778bb326cdf44093d702f6f016754cec",
            bgType: "image",
            bgImage: "https://infinityicon.infinitynewtab.com/icon/150127100751.png",
            target: "https://redirect.viglink.com?key=ddac7c192269498283581986ec8a9aaa&u=https%3A%2F%2Fwww.walmart.com%2F",
            type: "web"

Readable click handlerdeobfuscated/14.js

this._handleClick = t => {
  if (this.menu.toHide(), this.icon.children) {
    B.changeFolderFlipData({});
    B.openFolderWithIndexs(this.indexs);
    A.a.sendEvent({ action: "openFolder" });
  } else {
    const e = this.icon;
    if (B.iconEditing) {
      if (e.target === K.j.target) return;
      l.siteStore.setEditSite(e.id);
      l.pluginStore.show("editIcon");
      A.a.sendEvent({ action: { openEditicon: c.a.getTargetLogDomain(e.target) } });
    } else {
      if (A.a.sendEvent({ action: { openIcon: c.a.getTargetLogDomain(e.target) } }), lt(e.target)) return;
      const { link: i } = l.settingStore.setting;
      if (e.target.startsWith("chrome-app://")) return void c.a.openChromeApp(e.target.split("chrome-app://")[1], i.icon, t);
      if (e.target.startsWith("infinity://")) return o.h && "infinity://history" === e.target ? void c.a.openUrl("chrome://history/", i.icon, t) : "infinity://gmail" === e.target ? void c.a.openUrl("https://mail.google.com/mail/ca", i.icon, t) : "infinity://chrome-apps" === e.target ? (l.pluginStore.show(e.target), void X.a.openModal()) : !l.userStore.isLogin && o.s ? void l.userStore.toggleLoginTipModal() : void l.pluginStore.show(e.target);
      c.a.openUrl(e.target, i.icon, t);
    }
  }
}

Readable openUrl helperdeobfuscated/22.js

        openUrl: (t, e = !0, n) => {
          !n || 1 !== n.button && !h.ctrlKeyStatus(n) ? e ? o.s ? window.open(t, "_blank").focus() : window.chrome.tabs.create({
            url: t,
            active: !0
          }) : l(t) : o.s ? window.open(t, "_blank") : window.chrome.tabs.create({
            url: t,
            active: !1
          })
        },

05EvidenceTHIRD PARTY LIST

External hosts involved in the shopping shortcut path

sovrn.co
Affiliate redirect host used by the default Amazon shortcut and other default shopping shortcuts.
redirect.viglink.com
VigLink affiliate redirect host used by the default Walmart shortcut, with the Walmart URL embedded in the u parameter.
www.ebay.com
Retailer host opened by the eBay shortcut with eBay Partner Network attribution parameters in the URL.
infinityicon.infinitynewtab.com
Extension icon CDN observed serving the eBay shortcut image while the new tab grid rendered.

Where it sends data

Destinations our analysis observed Infinity New Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

Googlewidely used
Infinity New Tab sends data to Google. Named as a recipient by 45 other extensions we have analysed.
Facebook
Infinity New Tab sends data to Facebook. Named as a recipient by 13 other extensions we have analysed.
eBay
Infinity New Tab sends data to eBay. Named as a recipient by 3 other extensions we have analysed.
Weibo
Infinity New Tab sends data to Weibo. Named as a recipient by 1 other extensions we have analysed.
QQ
Infinity New Tab sends data to QQ. Named as a recipient in this extension's own analysis.
WeChat
Infinity New Tab sends data to WeChat. Named as a recipient in this extension's own analysis.