Security Warning: High Security Risk
Elevate Tab
ID: hlpiehmabbpniknaaopcmacpdiehlgng
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://elevatetab.com/View Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Elevate your mood with this amazing New Tab extension.
By clicking "Add to Chrome", I accept and agree to installing the Elevate Tab Extension and setting Chrome New Tab Search provider to Microsoft Bing as described by the service in EULA (https://elevatetab.com/eula.html) and Privacy Policy (https://elevatetab.com/privacy-policy.html). Have trouble concentrating? This add-on is intended for everyone who wants to gain laser focus. You won't believe how you used to function with a Chrome default new tab after downloading Elevate Tab. This custom tool will significantly increase your productivity, and your new tab page will be enhanced with numerous useful features. The collection of beautiful wallpapers is the first thing that catches your eye. You get to witness the most incredible landscapes and other works of art on each tab that is opened. The catch is, that you do not have to open a new tab every time. To see these awesome photos just click on the small logo in the top left corner and enjoy. Do not let rain surprise you and ruin your plans! This feature allows you to stay updated on the weather forecast. The temperature for the particular place may be found in the right upper corner. By using Elevate Tab it will come naturally to you to use our search feature which perfectly fits with beautiful wallpapers. We created a new feature for all hard workers out there. You can find it in the left bottom corner and by pressing the chair image you can set reminders. What is the purpose of reminders? Gentle reminders will remind you to take care of your posture because sitting for long periods of time can be harmful to your health. Keep track of time with the clock feature. If somehow you do not like one of these options, you can simply choose to see the ones you like! Just click the Settings and pick your favorites! Read more about this project here: https://elevatetab.com/ Privacy policy link: https://elevatetab.com/privacy-policy.html End-user license agreement: https://elevatetab.com/eula.html Feel free to contact us anytime: - By submitting a form on the page: https://elevatetab.com/#contact - By sending mail to the owner's address: Bulevar Šarla de Gola 2, Podgorica, Crna Gora - By sending an e-mail to [email protected]
All searches typed into the new-tab search box are redirected through search.nuthab.com (search hijacking) with persistent tracking identifiers attached: a per-user UID, the install week/year cohort, and an affiliate click_id. This is classic search-hijacker monetization that exfiltrates query content together with a stable user fingerprint, and the redirect is made over plain HTTP (not HTTPS), exposing the query string to network observers.
function startSearch() { let query = $('#SearchBar2') .val() .trim(); if (query.length === 0) { return; } chrome.storage.local.get( ['utm_uid', 'installation_week', 'installation_year'], data => { let queryStringObject = { e_uid: USER_ID, e_title: 'NutHubChrome', e_install_week: data['installation_week'], e_install_year: data['installation_year'], click_id: data['utm_uid'], }; let extra_params = encodeUrlParams(queryStringObject); window.location = 'http://search.nuthab.com/54489c1c-abb8-4147-91c3-1f9cb4d70dcf?q=' + query + '&' + extra_params; } );}On install, the extension generates a per-user UID and POSTs it together with an 'extension' identifier and theme code to nuthab.com/ch/install.php (an install/affiliate pixel). It also fetches a remote 'secret' token (`t`) and `utm_uid` (`sn`) from gen_ddl.php and persists them, which are later used to attribute monetized search traffic. This is per-install user tracking and affiliate attribution, with the server controlling tracking identifiers used by the client.
function fireInstallPixel(userId) { const genUrl = 'https://' + SEARCH_DOMAIN + '/ch/gen_ddl.php'; const url = 'https://' + SEARCH_DOMAIN + '/ch/install.php'; let parameters = { uid: userId, b: 'chrome', extension: EXTENSION, theme_index: EXTENSION_CODE, }; fetch(genUrl) .then(res => res.text()) .then(data => { const searchParams = new URLSearchParams(new URL(data) .search); const queryParams = Object.fromEntries(searchParams); SECRET = queryParams?.t; utm_uid = queryParams?.sn; chrome.storage.local.set({ secret: SECRET, utm_uid: utm_uid }); }) .then(() => fetch(url, { method: 'POST', body: JSON.stringify(parameters), }) )A timer (`createNotificationCheckInterval` runs every 15s) can programmatically force-open a new chrome://newtab tab. Since the extension overrides the new tab page with its own page (which contains monetized search and ads), this can drive recurring forced impressions of the extension's monetized page. Pinging users this aggressively from a background service worker is intrusive ad/engagement behavior.
function notification() { var show_notification = false; chrome.storage.local.get(['notification_settings'], function(items) { if (items['notification_settings'] !== undefined) { ... chrome.tabs.query({ active: true, currentWindow: true }, function(tabs) { var current_tab = null; for (let i in tabs) { if (tabs.hasOwnProperty(i)) { current_tab = tabs[i]; } } if (current_tab && current_tab['url'] === 'chrome://newtab/') { d('ShowOnSameTab', { info: notification_settings }); } else { if (show_notification) { chrome.tabs.create({ url: 'chrome://newtab', }); } } });The new-tab page calls a third-party geo-IP service (json.geoiplookup.io) and stores the entire response (which contains IP, latitude, longitude, ISP, city, etc.) in chrome.storage.local. The host json.geoiplookup.io is not declared in host_permissions and the data is more than what is needed to render a weather widget (lat/long would suffice). Weather requests are then proxied through nuthab.com/api/weather.php along with the user's coordinates.
function setLocation() { $.getJSON('https://json.geoiplookup.io/', function(data) { chrome.storage.local.set({ location: data }); // Fetch Weather data and populate widget getWeatherData(CACHE_KEY_WEATHER, COMMAND_GET_WEATHER, function(weather) { iWeatherRequestsCount++; $('#weather_widget__city') .html(weather.name);Server-supplied strings from nuthab.com's weather proxy (`weather.name`) are inserted into the DOM via jQuery `.html()` rather than `.text()`, which evaluates HTML and would execute any embedded `<img onerror=...>` style payload. Because nuthab.com is the same server that controls the affiliate `secret`/`utm_uid`, a compromised or malicious server response could inject script-like markup into the new tab page.
$('#weather_widget__city') .html(weather.name);let tempCelzius = weather.main.temp;...$('.detail-info__city') .html(weather.name);$('#weather_widget__temp') .html(Math.ceil(Math.abs(tempCelzius)));The extension integrates the adMarketplace 'Conducive Paid Suggest' ad library and renders paid ad links inside the new-tab search-box autocomplete. A hardcoded FEED_ID identifies the ad-partner account, and clickUrl templates from the ad partner are interpolated into anchor `href`s. This is monetized ad injection into the new tab UI.
const FEED_ID = '35b5d710-b7e7-11eb-a7dd-0a491188cbdf';...for (var i = 0; i < paid_suggestions.length; i++) { var suggestion = paid_suggestions[i]; ... var formatted_title = suggestion.key; var linkUrl = clickUrl .replaceAll('${brand.url}', suggestion.brand.url) .replaceAll('${brand.name}', suggestion.brand.name); AMP.utils.setElementInnerText(textSpan, formatted_title); AMP.utils.setElementInnerText(adsSpan, 'Ads '); ... AMP.utils.addElementAttribute(link, 'href', linkUrl); ... AMP.utils.addElementClass(link, 'ads-link');On install, a stable per-user UUID is generated client-side and persisted, then attached to every subsequent search request and to the install-pixel POST. Combined with installation_week/year cohort markers, this is a durable user fingerprint that ties every monetized search back to the same identity and install cohort across the user's lifetime on the device.
function onExtensionInstalled() { try { let year_and_week = common_functions.getWeekNumber(new Date()); installation_week = String(year_and_week[1]); installation_year = String(year_and_week[0]); chrome.storage.local.set({ installation_week: installation_week, installation_year: installation_year, }); } catch { console.log('Error getting week number'); } USER_ID = common_functions.makeUid(); chrome.storage.local.set({ userId: USER_ID }, function() { fireInstallPixel(USER_ID); });By severity
Versions scanned
Showing 1 of 12 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.5 | 7 |
Files with findings
3 distinct paths — top paths by unique finding count:
- lib/index.js3
- service-worker.js3
- lib/zero-park-search.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.