Is PandaTab 新标签页 safe?
PandaTab replaces your new tab with a full-screen iframe of tab.leisurelypanda.com and grants that remote page clipboard read access.
The extension ships no real logic of its own: its new-tab page and homepage are a borderless, full-window iframe that loads https://tab.leisurelypanda.com, so all content and behavior is served remotely and can change at any time without an extension update. The iframe is declared with allow="clipboard-read; clipboard-write", which delegates clipboard read permission to that remote origin, letting the page read your clipboard contents while a new tab is open. Every new tab you open loads this remote page.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote new-tab iframe gets clipboard access
PandaTab replaces the new-tab page with a local HTML file embedding https://tab.leisurelypanda.com as a full-page iframe.
The iframe delegates clipboard-read/write to that origin, so code from that site can request clipboard contents.
You open a new browser tab while PandaTab is installed.
The extension is registered as the browser's new-tab override.
The extension loads a remote page and grants it clipboard access.
The page at tab.leisurelypanda.com receives clipboard-read and clipboard-write through the iframe allow attribute.
| Field | Value | Why it matters | |
|---|---|---|---|
Remote new-tab page | https://tab.leisurelypanda.com | This is the external site that receives control of the visible new-tab page. | |
Clipboard read access | clipboard-read | This lets the framed page ask the browser for text you have copied. | |
Clipboard write access | clipboard-write | This lets the framed page ask the browser to replace clipboard contents. | |
Copied text at risk | Reset code 839214 (illustrative) | Clipboard text can include reset codes, internal URLs, account identifiers, or other values you recently copied. |
The shipped new-tab page delegates clipboard permissions to a cross-origin iframe
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="Description" content="一个简洁、美观、实用的浏览器起始页。">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>PandaTab</title>
<link rel="icon" href="favicon.ico" />
<link rel="shortcut icon" href="favicon.ico" />
<link rel="stylesheet" href="styles/init.css">
</head>
<body>
<iframe allow="clipboard-read; clipboard-write" src="https://tab.leisurelypanda.com"></iframe>
</body>
</html>- tab.leisurelypanda.com
Receives the framed new-tab navigation and is delegated clipboard-read and clipboard-write by the extension page.