Is The New York Times News safe?

Low risk

The New York Times News sources every headline, image, and click-through link from a third-party server, notifiernews.com, not NYT.

The extension polls notifiernews.com every few minutes and shows the response as native "NYT" notifications and popup feed items, but nothing in the pipeline checks that the server is affiliated with The New York Times or that any article URL points to nytimes.com — clicking a notification opens whatever link the server sends. The popup also inserts feed text (title, author, tags) into its page with unescaped HTML, so any markup the server includes in those fields would render as live content inside the extension.

lukasburnordv1.0.01Chrome Web Store
18Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension branded NYT News gets headlines and links from an unaffiliated server

This extension is branded as The New York Times but every headline, image, and article link it shows comes from notifiernews.com, a server with no affiliation to nytimes.com.

That server can point any headline at any destination.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

The alarm fires (about every 3 minutes) or the popup is opened.

The extension did this

The extension POSTs a device hash and version to notifiernews.com/nytimes_news/feed and writes the entire JSON reply into local storage.

The response is spread wholesale into chrome.storage.local with no schema or allowlist check on any field.

What the extension sends to notifiernews.com on every fetch
  • Device hash
    a91f3c7e2b0d5f6a

    A hash derived from a persistent per-install identifier, sent with every request.

  • Persistent install ID
    8f2e4a1c-9b3d-4e7f-a012-3456789abcde

    A separate persistent identifier generated on first install and stored locally.

  • Extension version
    1.0.01

    The extension's own version number, sent so the server can tailor its response.

The code that does this

The fetched response is written to storage with no validation

Readable version

Fetch call, no response validation

function postFeedRequest(url, body) {  return fetch(url, {    credentials: 'include',    method: 'POST',    body: body  }).then(res => res.headers.get('Content-Type')?.includes('json') ? res.json() : undefined);}

Storage write, response object spread wholesale

function storeFeedResponse(serverJson) {  const stored = serverJson || {};  stored.lastFetchTime = Date.now();  return chrome.storage.local.set(stored); // no field allowlist, no schema check}
What actually happens
You did this

A rendered headline or a push notification is clicked.

The extension did this

The extension opens a new tab at the exact url field from that feed item, without checking it points at nytimes.com.

Both the popup's link handler and the notification click handler call the same chrome.tabs.create({url}) path with the raw, unvalidated value.

The code that does this

Tab is opened at the raw feed url with no host check

Readable version
function openPage(url) {  return chrome.tabs.create({ url: url }).catch(() => { chrome.runtime.lastError; });}// on notification click, using the feed item's own url field:function onNotificationClicked(newsItem) {  openPage(newsItem.url); // no nytimes.com host check anywhere in this path}chrome.notifications.onClicked.addListener(onNotificationClicked);
Where the branded 'NYT' content actually comes from
    • notifiernews.com

    Unaffiliated server that supplies every headline, image, and click-through link the extension displays as New York Times content.

    • www.nytimes.com

    Only referenced as a static 'source' label in the popup UI; the extension never fetches from or verifies against this domain.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.01. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Show you desktop notifications

    notifications

Where it sends data

Destinations our analysis observed The New York Times News contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • notifiernews.com

    The New York Times News sends data to notifiernews.com. 3 other extensions we have analyzed send data here.