Is OceanHero: Save Our Oceans with Every New Tab safe?

Medium risk

OceanHero reads signed-in Google accounts and top-visited sites, and forwards your user ID to an ad network on every new tab.

On each new tab page load, the extension fetches your Google account names and email addresses from accounts.google.com, retrieves your top-visited websites via the topSites API, and sends your persistent user ID to bdn11.veve.com for ad targeting. It also collects your IP address and country code from two third-party APIs on every browser startup, and pulls remote feature-flag configuration from oceanhero.today that can alter the extension's behavior including ad display and search features.

OceanHero GmbHv10.7Chrome Web Store
53Risk
Who publishes it

OceanHero GmbH - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
OceanHero GmbH
Declared legal entity
OceanHero GmbH
Registered address
Goethestr. 38, C/O Marvin Burman, Düsseldorf 40237, DE
Registered contact
Marvin Burman

Same store account

1 other listing published from this account, 500k+ users between them, none of them carrying a finding.

Shared hosts - 11 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

usw1-new-salmon-33403.upstash.io
Also called by 1 other listing: OceanHero: Save Our Oceans by Surfing the Web
about.oceanhero.today
Also called by 2 other listings, including OceanHero: Save Our Oceans by Surfing the Web
api.thinksuggest.org
Also called by 2 other listings, including OceanHero: Save Our Oceans by Surfing the Web
assets.oceanhero.today
Also called by 2 other listings, including OceanHero: Save Our Oceans by Surfing the Web
marine-life.oceanhero.today
Also called by 2 other listings
oceanhero.zendesk.com
Also called by 2 other listings
p.oceanhero.today
Also called by 2 other listings
api.oceanhero.today
Also called by 3 other listings, including OpenTabs
wss.pollfish.com
Also called by 3 other listings
api.tenor.com
Also called by 4 other listings, including Product Fruits Editor
oceanhero.today
Also called by 4 other listings, including Motiontabs - Best Live Wallpaper Experience

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote Feature-Flag Config Fetched on Every New Tab

Each new tab, OceanHero fetches server config controlling which features run: ad tiles, banners, search suggestions, rewards.

The request sends your OS, version, install date, and experiment ID.

The server can flip these flags anytime.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open a new tab.

The extension checks whether the cached remote config is older than one hour and, if so, fetches a fresh copy.

The extension did this

The extension sends your OS, extension version, and installation date to OceanHero's server and receives a configuration that controls which features are active.

The returned scenario.featureFlags object governs ad tile display, banner visibility, search counter behavior, and reward mechanics.

Captured request
GEThttps://oceanhero.today/api/remote-config?platform=EXTENSION&version=10.7&appType=lite&appPlatform=extension&os=macOS&installationDate=1780737773110

2216-byte JSON object containing scenario.featureFlags with named boolean/value flags controlling ad tiles, banners, search, and engagement rewards

Query parameters sent to the remote-config endpoint
  • Operating system
    macOS

    The OS name (macOS, Windows, Linux) reported by the browser.

  • Extension version
    10.7

    The installed version of OceanHero.

  • Installation date
    1780737773110

    Unix-millisecond timestamp of when the extension was installed.

  • Experiment ID
    exp_042a8f

    Server-assigned A/B test identifier linking this browser to a specific experiment cohort.

  • Scenario ID
    scn_lite_003

    The specific feature-flag variant assigned to this browser.

The code that does this

Remote config fetch in bundle.js (function st, line 7443-7484)

Readable version
// function st({ experiment, installationDate }) — runs on NTP init (at most once/hour)const os = await getOS();const params = new URLSearchParams({  platform: 'EXTENSION',  version: '10.7',  appType: 'lite',  appPlatform: 'extension',  os,  ...(experiment?.scenario && experiment?.experimentId && {    experimentId: experiment.experimentId,    scenarioId: experiment.scenario.id,  }),  installationDate: String(installationDate),});const url = 'https://oceanhero.today/api/remote-config?' + params;const result = await fetch(url).then(r => r.ok ? r.json() : null);if (result && result.scenario) {  // Store experiment name as a cookie on oceanhero.today  setCookie('extensionExperimentName', result.scenario.name);  return result;  // scenario.featureFlags applied to extension state}
Feature flags remotely controlled by the server
  • AD_TILES
    adMarketplace

    Controls whether ad tiles from adMarketplace are displayed on the new tab page.

  • BANNER_ON
    true

    Controls whether promotional banner content is shown on the new tab page.

  • GOOGLE_COUNTER_ON
    true

    Controls whether search activity is counted toward the reward (shell) system.

  • DIMINISHING_RETURNS
    false

    Controls whether the shell reward rate decreases as search volume increases.

  • SURVEY_CHEST
    true

    Controls whether in-extension survey prompts are shown to high-activity users.

All Signed-In Google Accounts Enumerated on Every New Tab

Each new tab, OceanHero reads the name/email of every signed-in Google account via a session-cookie check and Google's ListAccounts API.

Data stays local for the tab UI, not sent to OceanHero, but visibility into identities is continuous.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open a new tab in Chrome.

OceanHero replaces the new tab page and initializes its UI, which includes loading Google account data.

The extension did this

The extension reads the name and email address of every Google account signed in to your browser.

It checks for a Google session cookie, then calls the Google ListAccounts API to enumerate all signed-in identities.

Captured request
GEThttps://accounts.google.com/ListAccounts?json=standard&source=ogb&md=1&cc=1&mn=1&mo=1&gpsia=1&listPages=1&authuser=0&origin=https%3A%2F%2Fwww.google.com&fwput=226

516-byte JSON payload containing name, email, profile picture URL, and login status for each signed-in Google account

Account data extracted from ListAccounts response
  • Display name
    Jane Smith

    The full name associated with each signed-in Google account.

  • Email address
    jane.smith@gmail.com

    The Gmail or Google Workspace email address for each account.

  • Profile picture URL
    https://lh3.googleusercontent.com/a/ACg8ocJ...

    A URL pointing to the account's Google profile photo.

  • Login status
    true

    Whether the account is currently active or in a signed-out state.

The code that does this

Google account enumeration in bundle.js (function Ot, line 7641-7679)

Readable version
// function Ot() — runs on every new tab page initialization// Step 1: check for active Google sessionconst cookies = await chrome.cookies.getAll({ url: 'https://accounts.google.com' });if (!cookies.length) return dispatch(fetchGoogleAccounts.fulfilled(null));// Step 2: fetch all signed-in accountsconst resp = await fetch('https://accounts.google.com/ListAccounts?' + new URLSearchParams({  json: 'standard', source: 'ogb', md: '1', cc: '1', mn: '1',  mo: '1', gpsia: '1', listPages: '1', authuser: '0',  origin: 'https://www.google.com', fwput: '226'}));// Step 3: parse each accountconst accounts = parsed[1].map(entry => ({  name: entry[2],  email: entry[3],  pictureUrl: entry[4],  isLogged: entry[15]}));dispatch(fetchGoogleAccounts.fulfilled(accounts));

IP Address Sent to Two Third-Party APIs on Install

Installing OceanHero makes its worker fetch your real IP from ipify.org, no notice shown, then pass it in the URL path to ipapi.co for a country lookup.

Both firms get your IP; values stay local, not sent to OceanHero, reaching two parties.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the OceanHero extension.

Installation triggers the background service worker's onInstalled event handler immediately.

The extension did this

The service worker sends your IP address to two third-party geolocation services.

First to api.ipify.org to retrieve the IP, then to ipapi.co with the IP embedded in the URL path to retrieve a country code.

Captured request
GEThttps://api.ipify.org?format=json

{"ip":"82.3.220.102"}

Captured request
GEThttps://ipapi.co/82.3.220.102/country/

US

The code that does this

IP and country code lookup in background.js (function j, line 413-434)

Readable version
// function j() — runs on chrome.runtime.onInstalledvar ip = yield fetch("https://api.ipify.org?format=json")  .then(r => r.json()).then(r => r.ip).catch(() => null);var countryCode = yield fetch("https://ipapi.co/" + ip + "/country/")  .then(r => r.text() || "US").catch(() => "US");chrome.storage.local.set({ ip: ip });chrome.storage.local.set({ countryCode: countryCode });
Services that receive the user's IP address
    • api.ipify.org

    Public IP lookup service operated by Elasticbyte Ltd. Receives the user's IP in the request itself.

    • ipapi.co

    IP geolocation service. Receives the user's IP address embedded in the URL path of the request.

+1 more finding not shown

What it can do

Permissions this extension asks for, as declared in version 10.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on oceanhero.today

    https://oceanhero.today/*

  • Read and change your data on accounts.google.com

    https://accounts.google.com/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Schedule its own background tasks

    alarms

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed OceanHero contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.ipify.orgwidely used

    OceanHero sends data to api.ipify.org. A widely used service: 41 other extensions we have analysed send data here.

  • ipapi.co

    OceanHero sends data to ipapi.co. 16 other extensions we have analysed send data here.

  • accounts.google.com

    OceanHero sends data to accounts.google.com. One other extension we have analysed sends data here.

  • oceanhero.today

    OceanHero sends data to oceanhero.today. One other extension we have analysed sends data here.

  • bdn11.veve.com

    OceanHero sends data to bdn11.veve.com. No other extension we have analysed sends data here.

  • p.oceanhero.today

    OceanHero sends data to p.oceanhero.today. No other extension we have analysed sends data here.

Updated 30 September 2026cdbccfkcpkmimlajcjpodelocoeifjhp