Is iTab新标签页 safe?
iTab is high risk. Granting iTab's optional search-overlay permission lets the extension run its own code on every website you visit. Version 2 expanded this from Baidu/Google only to all sites. The permission prompt does not clearly describe this capability.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
iTab v2 requests broad tab access and can inject scripts into any page
Granting iTab's optional search-overlay permission lets the extension run its own code on every website you visit.
Version 2 expanded this from Baidu/Google only to all sites.
The permission prompt does not clearly describe this capability.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You enable iTab's global search overlay feature, granting the extension access to all websites.
The permission request covers tabs, favicon, and <all_urls> origins, broader than most users expect for a new-tab extension.
The extension can now programmatically inject its code into any tab on demand when you press the overlay shortcut.
background.js uses chrome.scripting.executeScript to load content-scripts/content.js into the active tab, giving it full DOM access.
background.js, executeScript call path triggered by keyboard shortcut
chrome.commands.onCommand.addListener(async (command) => { if (command === 'openItabOverlay') { const { origins } = await chrome.permissions.getAll(); // Only proceeds if user has granted <all_urls> if (!origins.includes('<all_urls>')) return; getActiveTab(async (tab) => { try { // First try messaging the already-injected content script await chrome.tabs.sendMessage(tab.id, { type: 'openItabOverlay' }); } catch (err) { // If no content script loaded yet, inject it now await chrome.scripting.executeScript({ target: { tabId: tab.id }, files: ['/content-scripts/content.js'] }); await new Promise(resolve => setTimeout(resolve, 300)); await chrome.tabs.sendMessage(tab.id, { type: 'forceOpenItabOverlay' }); } }); }});overlay-e7CKLRCQ.js, permission request that unlocks <all_urls> access
async function requestAuthorized() { // Requests tabs + favicon permissions AND <all_urls> host access const granted = await window.chrome.permissions.request({ permissions: ['tabs', 'favicon'], origins: ['<all_urls>'] }); return granted ? Promise.resolve(true) : Promise.reject(false);}