Is OneNav safe?

Medium risk

OneNav sends each displayed saved bookmark URL to favicon.png.pub when loading favicons.

When the popup renders saved links, it builds favicon image URLs by base64-encoding each bookmark URL into requests to https://favicon.png.pub/v1/. The links come from the configured OneNav API or cached localStorage categories, so opening and expanding a category can transmit the full saved URL path and query string to that favicon service.

xiaozv1.1.0Chrome Web Store
45Risk
Who publishes it

xiaoz - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
xiaoz
Website
dwz.ovh/vd0bw

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Saved OneNav bookmark URLs are sent to favicon.png.pub in the popup

When you open OneNav's popup, the extension renders favicons for saved links.

Each displayed bookmark URL is encoded into a request to favicon.png.pub, sending the saved URL to that remote host.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the popup and views saved OneNav links.

The extension did this

The extension renders favicons by sending each saved bookmark URL to favicon.png.pub.

Captured request
GETfavicon.png.pub/v1/<base64-url>
Fields in the request
  • Saved bookmark URL
    https://example.com/saved-page (illustrative)

    Reveals the saved page whose favicon is being requested.

What it can do

Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

  • Show you desktop notifications

    notifications

  • See the address and title of every tab you have open

    tabs

  • Read whatever you have copied to your clipboard

    clipboardRead

Where it sends data

Destinations our analysis observed OneNav contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • favicon.png.pub

    OneNav sends data to favicon.png.pub. No other extension we have analysed sends data here.

Updated 30 September 2026omlkjgkogkfpjbdigianpdbjncdchdco