Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
3 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Beşiktaş JK Anasayfa, used by 5,000 people, is rated caution by Extension Auditor. Our code review reported 3 findings (3 medium), led by other. It comes from a trusted publisher and was last updated in June 2026.
Key findings
- Medium
Other
Every search shortcut is labelled and iconed as a well-known destination (`![domain withheld]` with the Google Images favicon, `![domain withheld]` with the YouTube favicon, `!amazon`, `![domain withheld]`) but each URL actually sends the query to the operator's own `[domain withheld] endpoint with a monetization tag (`rtag=bskts`) and an opaque `qsa`/`sig` pair. A user clicking the Google-branded tile reasonably expects Google, so the routing is deceptive rather than merely a default-search choice, and it is why chrome-stats records this listing as removed for policy_violation. The listing is a Beşiktaş fan new-tab page and declares no data collection, so handing typed queries to a third-party search broker is neither disclosed nor implied by the stated purpose.
- Medium
Tracking
Beyond the first-party beacon to `[domain withheld] (v, line 5298), the handler looks up `config.extensionOptions.analytics[eventType]` and fires an image pixel (H, line 5501) at whatever URL the remote ` ` response supplied, forwarding every server-issued `3rd_*` variable with the `3rd_` prefix stripped. Since the config is fetched from `[domain withheld] at every new tab (line 21116), the operator can enable arbitrary third-party endpoints after install without shipping an update, and the user-behaviour events routed through here include `bookmark_click`, `history_click`, `most_visited_click`, `favorite_click` and pings. The CWS listing declares no data collection at all, so none of this telemetry — let alone a runtime-configurable third-party recipient — is covered by disclosure.
- Medium
Other
Each new tab fetches a server-controlled configuration from `[domain withheld] with `credentials: "include"`, so [domain withheld] cookies are attached and the install is linkable across sessions and across every extension built on this template. The response is then allowed to overwrite `bangs` (where the user's searches are sent), `favoriteGroups` (the links shown on the new tab — matching the review complaint that removed favourites reappear) and `vars` (the parameters appended to every telemetry beacon). This makes the extension's outbound search destination and tracking parameters remotely mutable after review, which is why the shipped bundle alone cannot bound the behaviour users actually receive.
Analyst notes
This is a white-label new-tab template skinned for Beşiktaş JK: no content scripts, no host permissions, no, and history () plus topSites () are read only to render local panels. What keeps it out of 'benign' is the monetized search layer — every search tile at:5589 is labelled `![domain withheld]`, `![domain withheld]`, `!amazon`, `![domain withheld]` and painted with the matching favicons, yet all of them route to `[domain withheld] — plus a credentialed ` ` fetch (:21116) that can swap those search URLs and inject arbitrary third-party tracking pixels at runtime (:5560-5570), and beacons to `[domain withheld] while the CWS listing declares no data collection at all. Signals: chrome-stats corroborates with a policy_violation store removal (a policy issue, not malware); the ML score, the permhash cluster (80%) and the 56% publisher rate are largely one source — the internal note records the malware label as a bulk feed import with no affected version and no code review, and it plausibly tags the whole brandTURBO template family. Manifest mismatch (prompt step 4): the bundle is MV3 with `topSites`/`favicon`/`search` while the live listing is MV2 with `topSites` + optional `chrome://favicon/`; `favicon` is simply the MV3 form of `chrome://favicon/`, so the only real delta is `search`, which has zero `chrome.search` call sites anywhere in the bundle — declared but unused, an over-request rather than an escalation.
Beşiktaş JK Anasayfa Chrome extension security report
ID: aemgdkbmkaafofemchfpagabknlcjfcc
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- brandTURBO
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- DE
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- Straßburger Str. 55 Berlin 10405 DE
- Website
- Visit
Screenshots & videos
Install growth
- 3 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
3 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Resmi Beşiktaş JK Anasayfa uygulaması ile takımınızı destekleyin ve sizin için özelleştirilmiş bir tarayıcı deneyimine sahip olun.
Read the publisher’s full description
İnternet tarayıcınız için resmi Beşiktaş JK Anasayfa uygulaması. Kulübün ilk ve tek resmi chrome uygulaması Beşiktaş JK Anasayfa, kulübe dair tüm bilgilere ve özel içeriklere en kolay yoldan, en hızlı şekilde ve tüm detayları ile ulaşmanız için yeni adresiniz. Hemen Beşiktaş JK Chrome uygulamasını Windows ve Mac OS için indirin, her yeni sekme ile Beşiktaş'ı destekleyin, ve gündemi tarayıcınızdan takip edin.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
3 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from brandTURBO
- Fenerbahçe SK Anasayfa20,000 users
- Corinthians New Tab Startpage3,756 users
- Olympiacos FC1,823 users
- Wacken Open Air1,797 users
- Aston Villa1,434 users
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持88,000,000 users
- Passlit Openbook10,000,000 users
- Zotero Connector9,000,000 users
- Microsoft Bing Search for Chrome7,000,000 users