Is PandaTab 新标签页 safe?

Medium risk

PandaTab replaces your new tab with a full-screen iframe of tab.leisurelypanda.com and grants that remote page clipboard read access.

The extension ships no real logic of its own: its new-tab page and homepage are a borderless, full-window iframe that loads https://tab.leisurelypanda.com, so all content and behavior is served remotely and can change at any time without an extension update. The iframe is declared with allow="clipboard-read; clipboard-write", which delegates clipboard read permission to that remote origin, letting the page read your clipboard contents while a new tab is open. Every new tab you open loads this remote page.

leisurelypanda.comv1.0.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Remote new-tab iframe gets clipboard access

PandaTab replaces the new-tab page with a local HTML file embedding https://tab.leisurelypanda.com as a full-page iframe.

The iframe delegates clipboard-read/write to that origin, so code from that site can request clipboard contents.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a new browser tab while PandaTab is installed.

The extension is registered as the browser's new-tab override.

The extension did this

The extension loads a remote page and grants it clipboard access.

The page at tab.leisurelypanda.com receives clipboard-read and clipboard-write through the iframe allow attribute.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://tab.leisurelypanda.com/
The new-tab iframe navigates to the remote PandaTab page; no request body was recorded.
03EvidenceFIELD TABLE
Concrete values that delegate clipboard access
FieldValueWhy it matters
Remote new-tab page
https://tab.leisurelypanda.comThis is the external site that receives control of the visible new-tab page.
Clipboard read access
clipboard-readThis lets the framed page ask the browser for text you have copied.
Clipboard write access
clipboard-writeThis lets the framed page ask the browser to replace clipboard contents.
Copied text at risk
Reset code 839214 (illustrative)Clipboard text can include reset codes, internal URLs, account identifiers, or other values you recently copied.
04EvidenceCODE COMPARE
The code that does this

The shipped new-tab page delegates clipboard permissions to a cross-origin iframe

What it actually does
deobfuscated/index.htmldeobfuscated/index.html
<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="Description" content="一个简洁、美观、实用的浏览器起始页。">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>PandaTab</title>
    <link rel="icon" href="favicon.ico" />
    <link rel="shortcut icon" href="favicon.ico" />
   <link rel="stylesheet" href="styles/init.css">
</head>
<body>
    <iframe allow="clipboard-read; clipboard-write" src="https://tab.leisurelypanda.com"></iframe>
</body>
</html>
05EvidenceTHIRD PARTY LIST
Remote host involved in the new-tab page
  • tab.leisurelypanda.com

    Receives the framed new-tab navigation and is delegated clipboard-read and clipboard-write by the extension page.

Data recipients

tab.leisurelypanda.com
Updated 17 September 2026gbdafbdgpjfdajombdfefkmdiopjcobl