Is UP Tab safe?

Medium risk

UP Tab is medium risk. Typing a search in UP Tab's new-tab box submits it via GET to coinup.org/yhs instead of a search engine. Code review and live-page analysis both showed the same form destination, exposing search terms to coinup.org as URL parameters.

CoinUPv3.1.2Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM

ClassMALICIOUS

TypeUnexpected

CWECWE-200

SourceAI SANDBOX

UP Tab sends new-tab searches through coinup.org

Typing a search in UP Tab's new-tab box submits it via GET to coinup.org/yhs instead of a search engine.

Code review and live-page analysis both showed the same form destination, exposing search terms to coinup.org as URL parameters.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You search from the new-tab page that UP Tab installs.

The extension replaces Chrome's new-tab page with index.html.

The extension did this

The extension submits that search to coinup.org/yhs as a URL query.

The form uses method GET and names the search field q.

02EvidenceFIELD TABLE

Fields exposed by the search submission

Field	Value	Why it matters
Search URL	https://coinup.org/yhs?q=weather	Your search becomes part of a URL sent to the redirect endpoint.
Search words	weather	The words you type reveal the topic you searched for from the new-tab page.
Redirect host	coinup.org	The search request goes to coinup.org before any later search-result page is reached.

03EvidenceNETWORK CAPTURE

Captured request

GEThttps://coinup.org/yhs?q=weather

Browser navigation request; no request body is sent for this GET form submission.

04EvidenceCODE COMPARE

The code that does this

The new-tab override and search form that route queries to coinup.org

What it actually does

Show shipped source

Chrome loads the extension's page for every new tabmanifest.json

{
"update_url": "https://clients2.google.com/service/update2/crx",

    "chrome_url_overrides": {
       "newtab": "index.html"
    },
    "description": "UP brings you a NewTab with Time, Date and Search",
    "icons": {
        "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" 
    },
    "manifest_version": 3,
    "name" :"UP Tab",
    "version": "3.1.2"
 }

The search form submits q to coinup.org/yhs with GETindex.html

<!DOCTYPE html>
<html>
    <head>
    <title id="timetitle"></title>
        <link href="https://fonts.googleapis.com/css?family=Open+Sans+Condensed:300" rel="stylesheet">
        <link href="res/style.css" rel="stylesheet">
        <script src="js/moment-with-locales.min.js"></script>
        <script src="js/jquery-3.7.1.min.js"></script>
    <script src="js/jquery-ui.min.js"></script>
    <link href="js/jquery-ui.min.css" rel="stylesheet">
   
    </head>
    <body>
        <a href="https://coinup.org/privacy-policy.html" target="_blank"><img src="icons/icon48.png" style="position:fixed;top:10px;right:10px;"></a>
        <div id="bg"></div>
        <div id="centerblock">

            <div id="search">
                <form id="searchform" action="https://coinup.org/yhs?" method="GET">
                    <input id="searchbox" type="text" name="q" placeholder="SEARCH" autofocus required>
                </form>
                <div class="ui-autocomplete">
  </div>
            </div>

            <div id="time"></div>
            <div id="date"></div>
        </div>
<div style="position:fixed; bottom:5px;right:10px;">
    <a href="https://coinup.org/privacy-policy.html" target="_blank" style=" font-size:13px; color:#fff; text-decoration:none;">Privacy Policy</a>
    <a href="https://coinup.org/tos.html" target="_blank" style="margin-left:20px; font-size:13px; color:#fff; text-decoration:none;">Terms of Service</a>
<script src="js/timeupdate.js"></script>
<script src="js/wallpaper.js"></script>
</body>
</html>

05EvidenceTHIRD PARTY LIST

External destinations involved in the search flow

coinup.org
Receives searches submitted from the UP Tab new-tab search form at /yhs.