Is Safari New tab safe?

Medium risk

Safari New tab sends logged-in Google profile details to Mixpanel and syncs saved tab history to sfnewtab.ashusharmadev.com.

When you log in, the extension uses your Google profile email, name, locale, avatar, OS, and domain as Mixpanel profile and event identifiers. It also stores recently closed and saved tab URLs and titles in local collections and syncs the collection to sfnewtab.ashusharmadev.com with your bearer token, including on a 15-minute sync alarm.

Equibrev1.0.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Google profile details are sent to Mixpanel for profile analytics

When you use the logged-in Google profile flow, Safari New Tab sends profile details to Mixpanel at api.mixpanel.com/engage#profile-set.

This includes stored data such as email, name, locale, avatar, operating system, and domain values.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user completes a logged-in Google profile action.

The extension did this

The extension sends logged-in profile details to Mixpanel as a profile record and event identifier.

Captured request
POSTapi.mixpanel.com/engage#profile-set
Fields in the request
  • Stored profile data
    user@example.com (illustrative)

    Profile fields identify the logged-in Google account: email, name, locale, avatar, operating system, and domain values.

Observation

Verification confirmed that the profile-set request uses the logged-in email as part of the Mixpanel distinct identifier and sends profile fields to Mixpanel.

What it can do

Permissions this extension asks for, as declared in version 1.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on ashusharmadev.com

    https://*.ashusharmadev.com

  • Read and change your data on f.start.me

    https://f.start.me/

  • Read and change your data on api.mixpanel.com

    https://api.mixpanel.com/

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Sign you in with your Google account

    identity

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Safari New tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.mixpanel.comwidely used

    Safari New tab sends data to api.mixpanel.com. A widely used service: 35 other extensions we have analysed send data here.

  • sfnewtab.ashusharmadev.com

    Safari New tab sends data to sfnewtab.ashusharmadev.com. No other extension we have analysed sends data here.