Is PandaTab 新标签页 safe?
PandaTab replaces your new tab with a full-screen iframe of tab.leisurelypanda.com and grants that remote page clipboard read access.
The extension ships no real logic of its own: its new-tab page and homepage are a borderless, full-window iframe that loads https://tab.leisurelypanda.com, so all content and behavior is served remotely and can change at any time without an extension update. The iframe is declared with allow="clipboard-read; clipboard-write", which delegates clipboard read permission to that remote origin, letting the page read your clipboard contents while a new tab is open. Every new tab you open loads this remote page.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote new-tab iframe gets clipboard access
PandaTab replaces the new-tab page with a local HTML file embedding https://tab.leisurelypanda.com as a full-page iframe.
The iframe delegates clipboard-read/write to that origin, so code from that site can request clipboard contents.
What actually happens
You open a new browser tab while PandaTab is installed.
The extension is registered as the browser's new-tab override.
The extension loads a remote page and grants it clipboard access.
The page at tab.leisurelypanda.com receives clipboard-read and clipboard-write through the iframe allow attribute.
Captured request
The new-tab iframe navigates to the remote PandaTab page; no request body was recorded.
Concrete values that delegate clipboard access
- Remote new-tab pagehttps://tab.leisurelypanda.com
This is the external site that receives control of the visible new-tab page.
- Clipboard read accessclipboard-read
This lets the framed page ask the browser for text you have copied.
- Clipboard write accessclipboard-write
This lets the framed page ask the browser to replace clipboard contents.
- Copied text at riskReset code 839214 (illustrative)
Clipboard text can include reset codes, internal URLs, account identifiers, or other values you recently copied.
The code that does this
The shipped new-tab page delegates clipboard permissions to a cross-origin iframe
deobfuscated/index.html
deobfuscated/index.html<!DOCTYPE html><html lang="zh-CN"><head> <meta charset="UTF-8"> <meta name="Description" content="一个简洁、美观、实用的浏览器起始页。"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>PandaTab</title> <link rel="icon" href="favicon.ico" /> <link rel="shortcut icon" href="favicon.ico" /> <link rel="stylesheet" href="styles/init.css"></head><body> <iframe allow="clipboard-read; clipboard-write" src="https://tab.leisurelypanda.com"></iframe></body></html>Remote host involved in the new-tab page
- tab.leisurelypanda.com
Receives the framed new-tab navigation and is delegated clipboard-read and clipboard-write by the extension page.
Where it sends data
Destinations our analysis observed PandaTab 新标签页 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- tab.leisurelypanda.com
PandaTab 新标签页 sends data to tab.leisurelypanda.com. No other extension we have analyzed sends data here.