Is News New Tab + Search - City Backgrounds safe?

Medium risk

News New Tab routes search queries and news requests through third-party domains tied to a publisher affiliate key.

Each time a user opens a new tab, the extension fetches news from api.news-headlines.co using a hardcoded publisher ID (8FCC6A3D057104B870B51) that links requests to this specific extension. When a user submits a search, the query is forwarded to trends.search-hub.co with the same publisher key embedded in the URL, exposing the search term to that domain's operator. Both domains receive standard HTTP headers including IP address on every request.

Breinapps (Oded)v1.1.0Chrome Web Store
45Risk
Who publishes it

Brein Apps LTD - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Breinapps (Oded)
Declared legal entity
Brein Apps LTD
Website
breinapps.com

Same store account

1 other listing published from this account, 40 users between them. 1 of them carries a finding.

Flashing News40Medium

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.news-headlines.co
Also called by 1 other listing: Art New Tabs
trends.search-hub.co
Also called by 1 other listing: Art New Tabs

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab searches go to Search Hub with a publisher key

Code analysis shows a new-tab search navigates to trends.search-hub.co with your query appended to a publisher-keyed URL.

A live check captured this redirecting to m.search-api.co, carrying the query and publisher key as URL parameters.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You submit a search from the extension's new-tab page.

The page is installed as Chrome's new-tab override, so the search form appears when a new tab opens.

The extension did this

The extension navigates to a Search Hub URL that contains your query.

The same URL also contains publisher key 8FCC6A3D057104B870B51 in the path.

Fields carried by the search request
  • Your search text
    weather tomorrow (illustrative)

    The words you type into the new-tab search box become part of the request URL sent off the device.

  • Publisher key
    8FCC6A3D057104B870B51

    The request includes a stable key that ties the search flow to this extension's distribution channel.

  • Search URL
    https://trends.search-hub.co/v1/search/8FCC6A3D057104B870B51?q=weather%20tomorrow (illustrative)

    The destination URL combines the search text and publisher key, so the receiving service gets both together.

  • Redirect URL
    https://m.search-api.co/search_captcha.html?redirect=https://www.google.com/search?q=weather%20tomorrow&p_key=8FCC6A3D057104B870B51 (illustrative)

    The live endpoint can forward the same search text into another search URL while preserving the publisher key.

Captured request
GEThttps://m.search-api.co/search_captcha.html?redirect=https://www.google.com/search?q=<redacted>&p_key=8FCC6A3D057104B870B51&p_id=default&c=GB&search_id=iRXbJSXrcMXdGacX4iNWV0zdeKZtvC

Captured GET request carried a planted marker value in the redirect query and publisher key 8FCC6A3D057104B870B51 in p_key; no request body was recorded.

The code that does this

The new-tab search handler builds the outbound URL

Readable version

Search base and DOM handles

deobfuscated/newtab.js
// Search redirect (as requested)const SEARCH_BASE =  "https://trends.search-hub.co/v1/search/8FCC6A3D057104B870B51?q=";let batches = [];let batchIndex = -1;const newsRow = document.getElementById("newsRow");const statusText = document.getElementById("statusText");const prevBtn = document.getElementById("prevBtn");const nextBtn = document.getElementById("nextBtn");const refreshBtn = document.getElementById("refreshBtn");const searchForm = document.getElementById("searchForm");const searchInput = document.getElementById("searchInput");

Submit handler

deobfuscated/newtab.js
searchForm.addEventListener("submit", (e) => {  e.preventDefault();  const q = searchInput.value.trim();  if (!q) return;  window.location.href = SEARCH_BASE + encodeURIComponent(q);});
Hosts receiving or forwarding the search flow
    • trends.search-hub.co

    Initial Search Hub endpoint hardcoded in the extension; receives the encoded query in q and publisher key 8FCC6A3D057104B870B51 in the path.

    • m.search-api.co

    Live redirect endpoint observed during dynamic analysis; receives the query in a redirect URL and publisher key 8FCC6A3D057104B870B51 in p_key.

What it can do

Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.news-headlines.co

    https://api.news-headlines.co/* and 1 more

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed News New Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • trends.search-hub.co

    News New Tab sends data to trends.search-hub.co. 2 other extensions we have analysed send data here.

  • api.news-headlines.co

    News New Tab sends data to api.news-headlines.co. One other extension we have analysed sends data here.

Updated 30 September 2026omlcllhgbjdlnkcamjgihppdjighddei