Is Zen tab: Beautiful, simple new tab safe?

Medium risk

Zen tab sends your Chrome top-sites URLs to zen-tab.com for Most Visited thumbnails.

When the Most Visited widget loads on the new-tab page, the extension reads Chrome's top sites and requests thumbnails from zen-tab.com. Each thumbnail request includes the visited site's URL in a query parameter, so those top-site URLs are sent to zen-tab.com.

Agustin Bossov1.20Chrome Web Store
45Risk
Who publishes it

Agustin Bosso - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Agustin Bosso
Registered address
Mejia Lequerica 8, Barcelona 08028, España
Registered contact
Agustin Bosso

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Zen Tab sends your most-visited site URLs to zen-tab.com

Every time you open a new tab, Zen Tab reads your Chrome top sites and requests a thumbnail for each from zen-tab.com, sending that site's full URL in the request.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

Chrome loads the extension's new-tab replacement page instead of the default Chrome page.

The extension did this

The extension sends the URL of each of your most-visited sites to zen-tab.com.

It reads your top sites via chrome.topSites.get, then requests a thumbnail image from zen-tab.com for each one, embedding that site's URL in the request.

What zen-tab.com receives for each top site
  • A site you visit often
    https://www.bbc.com/

    The protocol, hostname and path of one of your top sites is sent in plaintext as the url parameter.

  • Extension build
    1.20 LOCAL - 1.16.2 CLIENT

    Identifies which build of the extension made the request.

Captured request
GEThttps://zen-tab.com/?version=1.20%20LOCAL%20-%201.16.2%20CLIENT&pag=thumb&url=https://www.bbc.com/

Observed during dynamic analysis: opening the new-tab page after visiting real sites fired 9 requests, 8 of which carried a real visited-site URL (including bbc.com, youtube.com and chatgpt.com) as the url parameter.

The code that does this

widgets.js builds the zen-tab.com thumbnail request from your top-sites URL

Readable version
mostVisited.start = function () {  var widget = this.create();  chrome.topSites.get(function (data) {    html = "<ul>";    if (data.length > 9 && data.length < 12) {      data = data.slice(0, 9);    }    function faviconURL(u) {      const url = new URL(chrome.runtime.getURL("/_favicon/"));      url.searchParams.set("pageUrl", u);      url.searchParams.set("size", "32");      return url.toString();    }    $.each(data, function (index, value) {      if (index < 12) {        // Reduce the visited URL to protocol + hostname + path        var a = $("<a>", { href: value.url })[0];        var simpleURL = a.protocol + "//" + a.hostname + a.pathname;        // Ask zen-tab.com for a thumbnail, embedding the visited-site URL        var thumbPicture =          "https://zen-tab.com/?version=" + $.zentab.fullversion +          "&pag=thumb&url=" + simpleURL;        $.zentab.widgets.mostVisited.load("thumb." + simpleURL, function (pic) {          if ($.isset(pic) && pic.life > new Date().getTime()) {            thumbPicture = pic.thumb; // cached, no request this time          } else {            // Cache miss: fetch the thumbnail image from zen-tab.com now            $.toDataURL(thumbPicture, function (dataUrl) {              if ($.isset(dataUrl)) {                $.zentab.widgets.mostVisited.save("thumb." + simpleURL, {                  thumb: dataUrl,                  life: new Date().getTime() + $.zentab.widgets.mostVisited.thumbLife,                });              }            });          }          html += "<li class='mv" + index + "'>...</li>"; // renders the tile        });      }    });    html += "</ul>";    $(widget).append(html);  });};
Where the data ends up
    • zen-tab.com

    The extension's own vendor domain. Generates the new-tab thumbnail image and, in doing so, receives the URL of every site in your Chrome top-sites list.

What it can do

Permissions this extension asks for, as declared in version 1.20. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on query.yahooapis.com

    http://query.yahooapis.com/v1/public/*

  • Read and change your data on weather.yahooapis.com

    http://weather.yahooapis.com/*

  • Read and change your data on fonts.googleapis.com

    http://fonts.googleapis.com/*

  • Read and change your data on zen-tab.com

    http://zen-tab.com/* and 1 more

  • Read and change your data on staticflickr.com

    https://*.staticflickr.com/*

  • Read your physical location

    geolocation

  • Read the sites you visit most

    topSites

  • Read and change your bookmarks

    bookmarks

  • Store data in your browser

    storage

favicon

Where it sends data

Destinations our analysis observed Zen tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • zen-tab.com

    Zen tab sends data to zen-tab.com. No other extension we have analysed sends data here.

Updated 30 September 2026lbhkibbnhbkppaidinikfepgfhegmoak