Is UP Tab safe?
UP Tab is medium risk. Typing a search in UP Tab's new-tab box submits it via GET to coinup.org/yhs instead of a search engine. Code review and live-page analysis both showed the same form destination, exposing search terms to coinup.org as URL parameters.
Who publishes itCoinUP - no other listings under this identity, 3 shared hostnames
CoinUP - no other listings under this identity, 3 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
UP Tab sends new-tab searches through coinup.org
Typing a search in UP Tab's new-tab box submits it via GET to coinup.org/yhs instead of a search engine.
Code review and live-page analysis both showed the same form destination, exposing search terms to coinup.org as URL parameters.
What actually happens
You search from the new-tab page that UP Tab installs.
The extension replaces Chrome's new-tab page with index.html.
The extension submits that search to coinup.org/yhs as a URL query.
The form uses method GET and names the search field q.
Fields exposed by the search submission
- Search URLhttps://coinup.org/yhs?q=weather
Your search becomes part of a URL sent to the redirect endpoint.
- Search wordsweather
The words you type reveal the topic you searched for from the new-tab page.
- Redirect hostcoinup.org
The search request goes to coinup.org before any later search-result page is reached.
Captured request
Browser navigation request; no request body is sent for this GET form submission.
The code that does this
The new-tab override and search form that route queries to coinup.org
Chrome loads the extension's page for every new tab
manifest.json{"update_url": "https://clients2.google.com/service/update2/crx", "chrome_url_overrides": { "newtab": "index.html" }, "description": "UP brings you a NewTab with Time, Date and Search", "icons": { "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" }, "manifest_version": 3, "name" :"UP Tab", "version": "3.1.2" } The search form submits q to coinup.org/yhs with GET
index.html<!DOCTYPE html><html> <head> <title id="timetitle"></title> <link href="https://fonts.googleapis.com/css?family=Open+Sans+Condensed:300" rel="stylesheet"> <link href="res/style.css" rel="stylesheet"> <script src="js/moment-with-locales.min.js"></script> <script src="js/jquery-3.7.1.min.js"></script> <script src="js/jquery-ui.min.js"></script> <link href="js/jquery-ui.min.css" rel="stylesheet"> </head> <body> <a href="https://coinup.org/privacy-policy.html" target="_blank"><img src="icons/icon48.png" style="position:fixed;top:10px;right:10px;"></a> <div id="bg"></div> <div id="centerblock"> <div id="search"> <form id="searchform" action="https://coinup.org/yhs?" method="GET"> <input id="searchbox" type="text" name="q" placeholder="SEARCH" autofocus required> </form> <div class="ui-autocomplete"> </div> </div> <div id="time"></div> <div id="date"></div> </div><div style="position:fixed; bottom:5px;right:10px;"> <a href="https://coinup.org/privacy-policy.html" target="_blank" style=" font-size:13px; color:#fff; text-decoration:none;">Privacy Policy</a> <a href="https://coinup.org/tos.html" target="_blank" style="margin-left:20px; font-size:13px; color:#fff; text-decoration:none;">Terms of Service</a><script src="js/timeupdate.js"></script><script src="js/wallpaper.js"></script></body></html>External destinations involved in the search flow
- coinup.org
Receives searches submitted from the UP Tab new-tab search form at /yhs.