Is Zombie new tab safe?
Zombie new tab sends searches and typed URLs from its new-tab box to spaceship-newtab.com.
Zombie new tab replaces the browser's new-tab page with its own search box. When you press Enter or click the search icon after typing a search or URL, the extension redirects the browser to spaceship-newtab.com with the entered text in the query string.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New-tab searches are redirected to spaceship-newtab.com
Typing a search or URL into Zombie new tab's search box navigates to spaceship-newtab.com with the entry in the q parameter.
The confirmed data flow is scoped to the extension's new-tab page, not arbitrary websites.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
A user submits the new-tab search box.
The extension navigates to spaceship-newtab.com with the submitted search text or typed URL in the q parameter.
- Search box entryweather tomorrow (illustrative)
This is the text the user submits from the new-tab search form.
- Typed URLhttps://example.com (illustrative)
A URL typed into the same box can reveal a destination the user intended to visit.
Verification found this flow on the extension's new-tab page and did not find evidence that the empty all-sites content script sends arbitrary website data.
What it can do
Permissions this extension asks for, as declared in version 1.6.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Zombie new tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- spaceship-newtab.com
Zombie new tab sends data to spaceship-newtab.com. No other extension we have analysed sends data here.