Is Movie Stream Tab safe?

Medium risk

Movie Stream Tab sends your Chrome top-sites URLs to Google's favicon service on its new-tab page.

When you open a new tab, the extension reads Chrome's top-sites list and displays those sites as shortcuts. For each displayed shortcut, it loads an image from Google's favicon endpoint with the site URL included in the request.

Visicom Media Inc.v5.3Chrome Web Store
45Risk
Who publishes it

Visicom Media Inc. - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Visicom Media Inc.
Declared legal entity
Visicom Media Inc.
Registered address
6200 Bd Taschereau suite 304, Brossard, QC J4W 1M7, CA

Same operator - 1 listing

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

1 more listing in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

vmnapi.net
Also called by 4 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Movie Stream Tab sends your top sites to Google on every new tab

Opening a new tab in Movie Stream Tab reads your Chrome top-sites list and sends each site's full URL to Google's favicon endpoint.

We observed 7 outbound requests, one per site, in a single test session.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

Movie Stream Tab overrides Chrome's default new-tab page.

The extension did this

The page reads your Chrome top-sites list and sends each site's URL to Google's favicon endpoint.

One request per site, with the full top-site URL embedded in the domain query parameter.

What's sent in each favicon request
  • Top site URL
    https://www.youtube.com/

    The address of a site you've visited enough for Chrome to list it among your top sites.

Captured request
GEThttps://www.google.com/s2/favicons?domain=https://www.youtube.com/&sz=128

Returns a 128x128 favicon image for the requested domain.

The code that does this

appendTopSites() builds the favicon request from your top-sites list

Readable version
function appendTopSites(){    document.querySelector(".top-sites-container ul").innerHTML = ""    chrome.storage.local.get("removedTopSites", data => {        let { removedTopSites } = data        chrome.topSites.get(topSites => {            topSites = topSites.filter(topSite => !removedTopSites.includes(topSite.url))            let topSitesContainer = document.querySelector('.top-sites-container ul')            for (let topSite of topSites){                topSitesContainer.insertAdjacentHTML('beforeend', `<li><a href="${ topSite.url }" title="${ topSite.title }"><img src="https://www.google.com/s2/favicons?domain=${ topSite.url }&sz=128"></a><span class="remove-top-btn" data-url="${ topSite.url }">X</span></li>`)            }        })    })}
Where the data goes
    • www.google.com

    Receives your Chrome top-sites URLs as the domain parameter of a favicon-lookup request, on every new tab you open.

Reproduce it yourself

Sends the same favicon-lookup request pattern the extension makes for each entry in your top-sites list.

Requires
  • Node.js 14+
verify_favicon_leak.js · js
// verify_favicon_leak.js// Reproduces the exact request Movie Stream Tab sends for each top-site URL.const https = require('https');// Replace with any URL from your own browsing history to see the pattern.const topSiteUrl = 'https://example.com/';const endpoint = `https://www.google.com/s2/favicons?domain=${topSiteUrl}&sz=128`;https.get(endpoint, res => {  console.log('Status:', res.statusCode);  console.log('Request URL:', endpoint);  console.log('This is the exact request shape the extension sends once per entry returned by chrome.topSites.get().');});
How to run it
  1. 1Save as verify_favicon_leak.js.
  2. 2Run `node verify_favicon_leak.js`.
  3. 3Open your browser devtools network tab, load the extension's new-tab page, and compare the requests it fires against this one.

What it can do

Permissions this extension asks for, as declared in version 5.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Movie Stream Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Movie Stream Tab sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

Updated 30 September 2026lbibpkfigcdfpdimdekkeipbojjgbcjg