nsion's new tab page and submit it."},"response":{"actor":"extension","summary":"The page sends that search to music-page.com with a fixed source tag."},"technicalNote":"manifest.json sets chrome_url_overrides.newtab to newpage.html. newpage.html contains a GET form because no method attribute is set; the default method is GET. asset/script.js only prevents submission when the q field is empty."},{"kind":"field_table","fields":[{"icon":"form","label":"Search text","meaning":"The words you type into the new tab search box are included in the request URL.","severity":"context","sampleValue":"music recommendations (illustrative)"},{"icon":"tag","label":"Source tag","meaning":"A fixed tag is sent with the search so the destination can identify the request as coming from this extension page.","severity":"context","sampleValue":"mpage"},{"icon":"url","label":"Search URL","meaning":"The destination and query string show where your search is sent.","severity":"context","sampleValue":"https://www.music-page.com/sapi/search.php?q=music%20recommendations&src=mpage (illustrative)"}],"caption":"Fields placed into the search request","technicalNote":"The HTML form names the text input q. A second input has name src and value mpage."},{"url":"https://www.music-page.com/sapi/search.php","kind":"network_capture","method":"GET","technicalNote":"Dynamic analysis captured the live extension page containing this form action and src=mpage field. The attempted form submission was a top-level browser navigation, not an XHR/fetch request, so no request body or response body was recorded."},{"kind":"code_compare","caption":"The new tab page hardcodes the remote search form","shipped":"","language":"html","deobfuscated":"","technicalNote":"Source: newpage.html lines 22-27 in both extracted and deobfuscated copies. The src input is represented by its id, name, and value because those fields establish the submitted parameter. The deobfuscated copy is identical for this snippet."},{"kind":"code_compare","caption":"The submit handler only blocks empty searches","shipped":"$$(document).ready(function () {\n $(\".input\").focus();\n\n $(\"#searchForm\").submit(function (e) {\n var query = $(\"input#search-term\");\n if (query.val().length === 0) {\n e.preventDefault();\n return false;\n }\n\n return true;\n });\n\n });","language":"js","deobfuscated":"$$(document).ready(function () {\n $(\".input\").focus();\n\n $(\"#searchForm\").submit(function (e) {\n var query = $(\"input#search-term\");\n if (query.val().length === 0) {\n e.preventDefault();\n return false;\n }\n\n return true;\n });\n\n });","technicalNote":"Source: asset/script.js lines 32-45 in both extracted and deobfuscated copies. Returning true allows the form's default GET navigation to the action URL."},{"kind":"code_compare","caption":"The manifest makes this page the browser's new tab","shipped":"\"chrome_url_overrides\": {\n \"newtab\": \"newpage.html\"\n }","language":"js","deobfu

Is Music-Page safe?

Findings