Is New tab page by start.me safe?

High risk

start.me is high risk. Dynamic analysis captured a GET to start.me/tools/register_extension_presence on new-tab open, with browser type and version (7.3) as URL parameters. Rate-limited to once per 3 hours; fires automatically, no user action needed.…

startmedevv7.3.0Chrome Web Store
65Risk
Who publishes it

start.me BV - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
startmedev
Declared legal entity
start.me BV
Registered address
Waalsdorperweg 16, Den Haag 2597JB, NL
Registered contact
Arjen Robijn
Website
support.start.me

Same store account

1 other listing published from this account, 6k+ users between them, none of them carrying a finding.

start.me Bookmarker6k+Low

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

support.start.me
Also called by 3 other listings, including Bookmarker by start.me
f.start.me
Also called by 5 other listings, including Bookmark Sidebar Workspace - Reading, Notes, RSS & Tabs, Safari New tab
kazupon.github.io
Also called by 5 other listings, including Bookmarker by start.me, Pixiv Toolkit

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends browser type and version to start.me on each new tab

Dynamic analysis captured a GET to start.me/tools/register_extension_presence on new-tab open, with browser type and version (7.3) as URL parameters.

Rate-limited to once per 3 hours; fires automatically, no user action needed.

Severity
Low vulnerability
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

The extension did this

The extension sends your browser type and version to start.me without asking.

A GET request fires automatically to start.me/tools/register_extension_presence with extension_type=newtab, browser=chrome, and version=7.3. This happens at most once every 3 hours.

Captured request
GEThttps://start.me/tools/register_extension_presence?extension_type=newtab&browser=chrome&version=7.3

No request body. Data is entirely in URL query parameters. Observed during dynamic analysis on extension load/new tab creation.

What the extension sends to start.me
  • Extension type
    newtab

    Tells start.me that you are using the new-tab version of the extension.

  • Browser name
    chrome

    Tells start.me which browser you are using.

  • Extension version
    7.3

    Tells start.me which version of the extension you have installed.

  • Session cookies
    _session=abc123xyz...

    If you are signed in to start.me, your session cookie is included, linking this request to your account.

The code that does this

The listener as it appears in the shipped extension source:

Readable version
// Constants defined earlier in the same file:// var PRIMARY_DOMAIN = 'start.me';// var SM_API_LOCATION = 'https://start.me';// var EXTENSION_TYPE = 'newtab';// var WINDOW_CURRENT_BROWSER = 'chrome';// var CURRENT_VERSION = '7.3';// var MIN_EXTENSION_INFO_UPDATE_DELAY = 3 * 60 * 60 * 1000; // 3 hours// Fires every time any new tab is created.chrome.tabs.onCreated.addListener(function () {  // Skip if fewer than 3 hours have passed since the last ping.  if (!Startme.checkExtensionInfoTimestampExpired()) return;  // Construct URL: https://start.me/tools/register_extension_presence?extension_type=newtab&browser=chrome&version=7.3  var url = 'https://start.me' + '/tools/register_extension_presence'    + '?extension_type=' + EXTENSION_TYPE   // 'newtab'    + '&browser=' + WINDOW_CURRENT_BROWSER // 'chrome'    + '&version=' + CURRENT_VERSION;        // '7.3'  // Record the time so the next call is suppressed for 3 hours.  Startme.updateExtensionInfoTimestamp();  // Send the GET request, including any existing start.me cookies.  fetch(url, { credentials: 'include' }).catch(function () {});});
Where this request goes
    • start.me

    The extension's own service. Receives the browser type, extension type, and version on each new-tab event (rate-limited to once per 3 hours).

What it can do

Permissions this extension asks for, as declared in version 7.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on start.me

    https://start.me/

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

Updated 30 September 2026cfmnkhhioonhiehehedmnjibmampjiab