Is Zen tab: Beautiful, simple new tab safe?
Zen tab sends your Chrome top-sites URLs to zen-tab.com for Most Visited thumbnails.
When the Most Visited widget loads on the new-tab page, the extension reads Chrome's top sites and requests thumbnails from zen-tab.com. Each thumbnail request includes the visited site's URL in a query parameter, so those top-site URLs are sent to zen-tab.com.
Who publishes itAgustin Bosso - no other listings under this identity
Agustin Bosso - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Zen Tab sends your most-visited site URLs to zen-tab.com
Every time you open a new tab, Zen Tab reads your Chrome top sites and requests a thumbnail for each from zen-tab.com, sending that site's full URL in the request.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new browser tab.
Chrome loads the extension's new-tab replacement page instead of the default Chrome page.
The extension sends the URL of each of your most-visited sites to zen-tab.com.
It reads your top sites via chrome.topSites.get, then requests a thumbnail image from zen-tab.com for each one, embedding that site's URL in the request.
- A site you visit oftenhttps://www.bbc.com/
The protocol, hostname and path of one of your top sites is sent in plaintext as the url parameter.
- Extension build1.20 LOCAL - 1.16.2 CLIENT
Identifies which build of the extension made the request.
Observed during dynamic analysis: opening the new-tab page after visiting real sites fired 9 requests, 8 of which carried a real visited-site URL (including bbc.com, youtube.com and chatgpt.com) as the url parameter.
widgets.js builds the zen-tab.com thumbnail request from your top-sites URL
mostVisited.start = function () { var widget = this.create(); chrome.topSites.get(function (data) { html = "<ul>"; if (data.length > 9 && data.length < 12) { data = data.slice(0, 9); } function faviconURL(u) { const url = new URL(chrome.runtime.getURL("/_favicon/")); url.searchParams.set("pageUrl", u); url.searchParams.set("size", "32"); return url.toString(); } $.each(data, function (index, value) { if (index < 12) { // Reduce the visited URL to protocol + hostname + path var a = $("<a>", { href: value.url })[0]; var simpleURL = a.protocol + "//" + a.hostname + a.pathname; // Ask zen-tab.com for a thumbnail, embedding the visited-site URL var thumbPicture = "https://zen-tab.com/?version=" + $.zentab.fullversion + "&pag=thumb&url=" + simpleURL; $.zentab.widgets.mostVisited.load("thumb." + simpleURL, function (pic) { if ($.isset(pic) && pic.life > new Date().getTime()) { thumbPicture = pic.thumb; // cached, no request this time } else { // Cache miss: fetch the thumbnail image from zen-tab.com now $.toDataURL(thumbPicture, function (dataUrl) { if ($.isset(dataUrl)) { $.zentab.widgets.mostVisited.save("thumb." + simpleURL, { thumb: dataUrl, life: new Date().getTime() + $.zentab.widgets.mostVisited.thumbLife, }); } }); } html += "<li class='mv" + index + "'>...</li>"; // renders the tile }); } }); html += "</ul>"; $(widget).append(html); });};- zen-tab.com
The extension's own vendor domain. Generates the new-tab thumbnail image and, in doing so, receives the URL of every site in your Chrome top-sites list.
What it can do
Permissions this extension asks for, as declared in version 1.20. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on query.yahooapis.com
http://query.yahooapis.com/v1/public/*
Read and change your data on weather.yahooapis.com
http://weather.yahooapis.com/*
Read and change your data on fonts.googleapis.com
http://fonts.googleapis.com/*
Read and change your data on zen-tab.com
http://zen-tab.com/* and 1 more
Read and change your data on staticflickr.com
https://*.staticflickr.com/*
Read your physical location
geolocation
Read the sites you visit most
topSites
Read and change your bookmarks
bookmarks
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Zen tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- zen-tab.com
Zen tab sends data to zen-tab.com. No other extension we have analysed sends data here.