Is Tally Tab safe?
Tally Tab sends searches typed on its new-tab page to r.bsc.sien.com with affiliate tracking parameters.
Tally Tab replaces the browser's new tab page with a calculator and search form. When a user submits that search form, it reads the typed query and redirects the tab to r.bsc.sien.com/search with FORM, PC, PTAG, and q parameters.
Who publishes itOZ - 2 other listings from the same operator, 1 of them carrying a finding
OZ - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 8k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New-tab searches redirect to Sien affiliate search endpoint
When you submit a search from Tally Tab's new-tab page, the extension redirects the query to r.bsc.sien.com with affiliate tracking parameters.
The transmitted data is the text you entered in the extension's search form.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user submits a search from the extension's new-tab page.
The extension URL-encodes the form input and redirects the browser to r.bsc.sien.com/search with the query and affiliate tracking parameters.
- Your search queryweather tomorrow (illustrative)
The words entered into the extension's new-tab search box are sent as the search request's q parameter.
Where it sends data
Destinations our analysis observed Tally Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- r.bsc.sien.com
Tally Tab sends data to r.bsc.sien.com. One other extension we have analysed sends data here.