Is Woodwo New Tab safe?
Woodwo New Tab replaces every new tab with an instant redirect to www.woodwo.net.
The extension overrides the browser's new tab page with an HTML page containing a meta-refresh tag that forwards the user to www.woodwo.net within milliseconds of opening a tab. The extension contains no other code or user-visible functionality. Each redirect transmits the user's IP address and browser headers to www.woodwo.net.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New tab override redirects every new tab to woodwo.net, exposing IP
This extension's new tab page redirects to https://www.woodwo.net/ via an HTML meta-refresh on every new tab, no interaction needed.
Confirmed: opening a new tab fires GETs to www.woodwo.net, which gets the visitor's IP and browser headers.
What actually happens
You open a new browser tab.
The extension's new tab page immediately redirects the tab to https://www.woodwo.net/.
The redirect runs automatically with no click or confirmation, so every new tab leaves the browser's normal new tab page and loads woodwo.net instead.
The code that does this
The override declaration and the redirect it loads
What the page does
pages/page.html:2// The override page contains no scripts. Its only content is a// meta-refresh tag that navigates the tab to the external host// with a 0-second delay, i.e. immediately on load.// content="0; url=https://www.woodwo.net/"// http-equiv="refresh"// Result: every new tab open => navigation to https://www.woodwo.net/Captured request
Observed during dynamic analysis: opening the new tab override navigated off the extension origin and emitted three GET requests to https://www.woodwo.net/. The host did not resolve from the analysis environment at scan time, so no response body was returned; when the host is live it receives the request including the visitor IP and headers shown.
- User-Agent
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- Accept-Language
- en-US,en;q=0.9
What www.woodwo.net receives on each new tab open
- Your IP address203.0.113.47
Every navigation to the host exposes your public IP address, which approximates your location and identifies your network.
- Browser headersChrome/124.0.0.0; Windows NT 10.0; en-US
The User-Agent and related headers describe your browser, operating system, and language, contributing to a recognizable fingerprint.
Destination of the new tab redirect
- www.woodwo.net
Receives a navigation request on every new tab, including the visitor's IP address and browser headers. The hardcoded redirect target in the extension's new tab override page.
Reproduce it yourself
Extracts the new tab override page from an unpacked copy of the extension and prints the redirect target, letting you confirm that every new tab navigates to the external host.
- bash
- python3
- grep
#!/usr/bin/env bash# Confirm the new tab override redirects to an external host.# Run against an unpacked copy of the extension directory.set -euo pipefailEXT_DIR="${1:?usage: check_newtab_redirect.sh <unpacked-extension-dir>}"# 1. Which page is registered as the new tab override?OVERRIDE=$(python3 -c "import json,sys; m=json.load(open(sys.argv[1])); print(m.get('chrome_url_overrides',{}).get('newtab',''))" "$EXT_DIR/manifest.json")echo "newtab override page: $OVERRIDE"# 2. What does that page redirect to?grep -oE 'url=[^\"]+' "$EXT_DIR/$OVERRIDE" || echo "(no meta-refresh url found)"- 1Unpack the extension (e.g. unzip the .crx).
- 2Run: ./check_newtab_redirect.sh <unpacked-extension-dir>.
- 3Confirm the printed override page is pages/page.html and the redirect url is https://www.woodwo.net/.
Where it sends data
Destinations our analysis observed Woodwo New Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.woodwo.net
Woodwo New Tab sends data to www.woodwo.net. No other extension we have analyzed sends data here.