sing an HTML meta-refresh rather than JavaScript. During dynamic analysis, opening the new tab override navigated away from the extension's own page and emitted GET requests to www.woodwo.net. When that host is reachable, it receives the visitor's IP address and browser headers on every new tab open.","userSummary":"This extension replaces the browser's new tab page with a page that immediately redirects to https://www.woodwo.net/. The redirect runs on every new tab open with no interaction, using an HTML meta-refresh rather than JavaScript. During dynamic analysis, opening the new tab override navigated away from the extension's own page and emitted GET requests to www.woodwo.net. When that host is reachable, it receives the visitor's IP address and browser headers on every new tab open.","severity":"high","verificationStatus":"confirmed","timeline":[{"icon":"navigation","actor":"user","label":"Open new tab","detail":"The user opens a new browser tab with Ctrl+T / Cmd+T or the tab bar."},{"icon":"extension","actor":"extension","label":"Override loads","detail":"Chrome loads the extension's override page (pages/page.html) instead of the default new tab UI."},{"icon":"external_link","actor":"extension","label":"Meta-refresh fires","detail":"A single tag redirects the tab to https://www.woodwo.net/ with a zero-second delay."},{"icon":"remote_host","actor":"remote","label":"Host receives request","detail":"www.woodwo.net receives the navigation request, including the visitor's IP address and browser headers."}],"blocks":[{"kind":"cause_effect","trigger":{"actor":"user","summary":"You open a new browser tab."},"response":{"actor":"extension","detail":"The redirect runs automatically with no click or confirmation, so every new tab leaves the browser's normal new tab page and loads woodwo.net instead.","summary":"The extension's new tab page immediately redirects the tab to https://www.woodwo.net/."}},{"kind":"code_compare","caption":"The override declaration and the redirect it loads","shipped":[{"code":"\"chrome_url_overrides\": {\n \"newtab\": \"pages/page.html\"\n}","caption":"manifest.json — registers the new tab override","sourceFile":"manifest.json"},{"code":"\n\n\n\n","caption":"pages/page.html — the entire page is a redirect","sourceFile":"pages/page.html"}],"language":"html","deobfuscated":[{"code":"// The override page contains no scripts. Its only content is a\n// meta-refresh tag that navigates the tab to the external host\n// with a 0-second delay, i.e. immediately on load.\n// content=\"0; url=https://www.woodwo.net/\"\n// http-equiv=\"refresh\"\n// Result: every new tab open => navigation to https://www.woodwo.net/","caption":"What the page does","sourceFile":"pages/page.html:2"}],"technicalNote":"manifest_version 3, permissions: [] (none declared). The redirect uses an HTML meta-refresh, not JavaScript, so it is unaffected by the extension's script-src 'self' CSP. No other code ships in the extension."},{"url":"https://www.woodwo.net/","kind":"network_capture","method":"GET","headers":{"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Accept-Language":"en-US,en;q=0.9"},"technicalNote":"Captured during dynamic analysis as page-sourced navigation requests triggered by the meta-refresh. Header values shown are representative of the navigating browser; the source IP is the visitor's public IP, not captured verbatim here.","responseSummary":"Observed during dynamic analysis: opening the new tab override navigated off the extension origin and emitted three GET requests to https://www.woodwo.net/. The host did not resolve from the analysis environment at scan time, so no response body was returned; when the host is live it receives the request including the visitor IP and headers shown."},{"kind":"field_table","fields":[{"icon":"globe","label":"Yo

Is Woodwo New Tab safe?

Findings