Is OceanHero: Save Our Oceans with Every New Tab safe?
OceanHero reads signed-in Google accounts and top-visited sites, and forwards your user ID to an ad network on every new tab.
On each new tab page load, the extension fetches your Google account names and email addresses from accounts.google.com, retrieves your top-visited websites via the topSites API, and sends your persistent user ID to bdn11.veve.com for ad targeting. It also collects your IP address and country code from two third-party APIs on every browser startup, and pulls remote feature-flag configuration from oceanhero.today that can alter the extension's behavior including ad display and search features.
Who publishes itOceanHero GmbH - 1 other listing from the same operator, none carrying a finding
OceanHero GmbH - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 500k+ users between them, none of them carrying a finding.
Shared hosts - 11 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote Feature-Flag Config Fetched on Every New Tab
Each new tab, OceanHero fetches server config controlling which features run: ad tiles, banners, search suggestions, rewards.
The request sends your OS, version, install date, and experiment ID.
The server can flip these flags anytime.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open a new tab.
The extension checks whether the cached remote config is older than one hour and, if so, fetches a fresh copy.
The extension sends your OS, extension version, and installation date to OceanHero's server and receives a configuration that controls which features are active.
The returned scenario.featureFlags object governs ad tile display, banner visibility, search counter behavior, and reward mechanics.
2216-byte JSON object containing scenario.featureFlags with named boolean/value flags controlling ad tiles, banners, search, and engagement rewards
- Operating systemmacOS
The OS name (macOS, Windows, Linux) reported by the browser.
- Extension version10.7
The installed version of OceanHero.
- Installation date1780737773110
Unix-millisecond timestamp of when the extension was installed.
- Experiment IDexp_042a8f
Server-assigned A/B test identifier linking this browser to a specific experiment cohort.
- Scenario IDscn_lite_003
The specific feature-flag variant assigned to this browser.
Remote config fetch in bundle.js (function st, line 7443-7484)
// function st({ experiment, installationDate }) — runs on NTP init (at most once/hour)const os = await getOS();const params = new URLSearchParams({ platform: 'EXTENSION', version: '10.7', appType: 'lite', appPlatform: 'extension', os, ...(experiment?.scenario && experiment?.experimentId && { experimentId: experiment.experimentId, scenarioId: experiment.scenario.id, }), installationDate: String(installationDate),});const url = 'https://oceanhero.today/api/remote-config?' + params;const result = await fetch(url).then(r => r.ok ? r.json() : null);if (result && result.scenario) { // Store experiment name as a cookie on oceanhero.today setCookie('extensionExperimentName', result.scenario.name); return result; // scenario.featureFlags applied to extension state}- AD_TILESadMarketplace
Controls whether ad tiles from adMarketplace are displayed on the new tab page.
- BANNER_ONtrue
Controls whether promotional banner content is shown on the new tab page.
- GOOGLE_COUNTER_ONtrue
Controls whether search activity is counted toward the reward (shell) system.
- DIMINISHING_RETURNSfalse
Controls whether the shell reward rate decreases as search volume increases.
- SURVEY_CHESTtrue
Controls whether in-extension survey prompts are shown to high-activity users.
All Signed-In Google Accounts Enumerated on Every New Tab
Each new tab, OceanHero reads the name/email of every signed-in Google account via a session-cookie check and Google's ListAccounts API.
Data stays local for the tab UI, not sent to OceanHero, but visibility into identities is continuous.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open a new tab in Chrome.
OceanHero replaces the new tab page and initializes its UI, which includes loading Google account data.
The extension reads the name and email address of every Google account signed in to your browser.
It checks for a Google session cookie, then calls the Google ListAccounts API to enumerate all signed-in identities.
516-byte JSON payload containing name, email, profile picture URL, and login status for each signed-in Google account
- Display nameJane Smith
The full name associated with each signed-in Google account.
- Email addressjane.smith@gmail.com
The Gmail or Google Workspace email address for each account.
- Profile picture URLhttps://lh3.googleusercontent.com/a/ACg8ocJ...
A URL pointing to the account's Google profile photo.
- Login statustrue
Whether the account is currently active or in a signed-out state.
Google account enumeration in bundle.js (function Ot, line 7641-7679)
// function Ot() — runs on every new tab page initialization// Step 1: check for active Google sessionconst cookies = await chrome.cookies.getAll({ url: 'https://accounts.google.com' });if (!cookies.length) return dispatch(fetchGoogleAccounts.fulfilled(null));// Step 2: fetch all signed-in accountsconst resp = await fetch('https://accounts.google.com/ListAccounts?' + new URLSearchParams({ json: 'standard', source: 'ogb', md: '1', cc: '1', mn: '1', mo: '1', gpsia: '1', listPages: '1', authuser: '0', origin: 'https://www.google.com', fwput: '226'}));// Step 3: parse each accountconst accounts = parsed[1].map(entry => ({ name: entry[2], email: entry[3], pictureUrl: entry[4], isLogged: entry[15]}));dispatch(fetchGoogleAccounts.fulfilled(accounts));IP Address Sent to Two Third-Party APIs on Install
Installing OceanHero makes its worker fetch your real IP from ipify.org, no notice shown, then pass it in the URL path to ipapi.co for a country lookup.
Both firms get your IP; values stay local, not sent to OceanHero, reaching two parties.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install the OceanHero extension.
Installation triggers the background service worker's onInstalled event handler immediately.
The service worker sends your IP address to two third-party geolocation services.
First to api.ipify.org to retrieve the IP, then to ipapi.co with the IP embedded in the URL path to retrieve a country code.
{"ip":"82.3.220.102"}
US
IP and country code lookup in background.js (function j, line 413-434)
// function j() — runs on chrome.runtime.onInstalledvar ip = yield fetch("https://api.ipify.org?format=json") .then(r => r.json()).then(r => r.ip).catch(() => null);var countryCode = yield fetch("https://ipapi.co/" + ip + "/country/") .then(r => r.text() || "US").catch(() => "US");chrome.storage.local.set({ ip: ip });chrome.storage.local.set({ countryCode: countryCode });- api.ipify.org
Public IP lookup service operated by Elasticbyte Ltd. Receives the user's IP in the request itself.
- ipapi.co
IP geolocation service. Receives the user's IP address embedded in the URL path of the request.
+1 more finding not shown
What it can do
Permissions this extension asks for, as declared in version 10.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on oceanhero.today
https://oceanhero.today/*
Read and change your data on accounts.google.com
https://accounts.google.com/*
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
Read the sites you visit most
topSites
Store an unlimited amount of data in your browser
unlimitedStorage
Schedule its own background tasks
alarms
Run searches with your default search engine
search
Where it sends data
Destinations our analysis observed OceanHero contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.ipify.orgwidely used
OceanHero sends data to api.ipify.org. A widely used service: 41 other extensions we have analysed send data here.
- ipapi.co
OceanHero sends data to ipapi.co. 16 other extensions we have analysed send data here.
- accounts.google.com
OceanHero sends data to accounts.google.com. One other extension we have analysed sends data here.
- oceanhero.today
OceanHero sends data to oceanhero.today. One other extension we have analysed sends data here.
- bdn11.veve.com
OceanHero sends data to bdn11.veve.com. No other extension we have analysed sends data here.
- p.oceanhero.today
OceanHero sends data to p.oceanhero.today. No other extension we have analysed sends data here.