Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
3 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Fenerbahçe SK Anasayfa, used by 20,000 people, is rated caution by Extension Auditor. Our code review reported 4 findings (3 high, 1 medium), led by unauthorized data collection. It comes from a trusted publisher and was last updated in June 2026.
Key findings
- High
Unauthorized Data Collection
The anchor renders with href set to the user's real destination, but onClick rewrites e.currentTarget.href to the value of data-url, which module 39173's exported helper Ay (:6116, `R`) builds as [domain withheld] URL>&t=mv|nq&rtag=fnrbhc. The `mv` type is fed directly from chrome.topSites.get (:10529), so the user's frequently-visited site URLs are handed to [domain withheld] on every click; the same wrapper is applied to browser history entries in:186 with t="hc". Swapping href only at click time means hover and inspection show the genuine URL, concealing the interposed hop, and the destination domain is neither the publisher's declared website nor the [domain withheld] privacy-policy domain while the CWS data-collection disclosure is "none declared".
- High
Unauthorized Data Collection
Entries returned by chrome.history.search (:21389) are rendered with the real URL in href, then the click handler replaces href with the [domain withheld] wrapper carrying t="hc" and the full history URL as a query parameter. Browsing-history URLs therefore reach a search-monetisation domain that is not the publisher's declared website or privacy-policy host, and the extension's CWS listing declares no data collection at all. The href-at-click-time swap prevents the real navigation target from being visible before the click.
- High
Other
The bundled manifest is manifest_version 3 with permissions, whereas the live CWS listing summary reports manifest_version 2 with permissions [topSites] and optional_permissions [history, bookmarks, chrome://favicon/]. The delta is consistent with an MV2-to-MV3 migration rather than a covert escalation: chrome://favicon/ became the MV3 `favicon` permission, the embedded build config at:227317 still records manifestOptions exactly matching the published set, and the only genuinely new entry, `search`, is never exercised (no chrome.search call exists anywhere in the bundle). externally_connectable is scoped to [domain withheld] and its handler in only returns the extension version.
- Medium
Other
C is extensionOptions.contentPromotion (:20631), and the response from [domain withheld] is dispatched into the Redux store at:21164 (`n(on(g))`, with `g.vars && n($t(g.vars))` doing the same for vars). The operator can therefore switch on a one-shot full-page redirect of every new tab to an arbitrary URL after review, with no extension update; contentPromotion is absent from the bundled default config, so the capability ships dormant. The same server-supplied config drives extensionOptions.analytics, whose URLs are loaded as tracking pixels with the server-set 3rd_* vars forwarded (:5551-5572), and those server-set vars are also merged into every beacon.
Analyst notes
This is a genuine Fenerbahçe-branded MV3 new-tab page (, no content scripts, no host permissions, no APIs), but it contains two undisclosed grayware behaviours: clicks on top-sites and history entries are silently re-pointed at [domain withheld] (:104-113,:184-189, helper at:6116) while the rendered href still shows the real destination, and the response is dispatched straight into the store (:21164) so the server can switch on a full-page redirect (:20658) and extra third-party pixels without a store update. The ML evidence does not reproduce in this code: there are zero real eval() calls, the single `new Function` is webpack's globalThis shim (:663187 region), the fromCharCode hits are the whatwg-fetch polyfill, object-assign and React, and both createElement("script") hits are the webpack chunk loader and Sentry's report dialog — so the ML signal contradicts the source, while the malext feed label, the 80% permhash cluster and the 56% publisher rate are one correlated labelling source (the feed note itself says it is "not an independent code review"), not three independent confirmations; chrome-stats reports removal for policy_violation, not malware, which matches grayware rather than malware. Confidence is capped at medium because the supplied bundle has 10 JS files while the model counted 28, and the lazily-loaded search-bar component (`Pt`, rendered under Suspense) is absent, so the handling of typed search queries — including whether the `search` analytics action at:220963 ever fires with the query text — could not be verified.
Fenerbahçe SK Anasayfa Chrome extension security report
ID: emiklbjioldhimlgpcembkhdabhjbehh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- brandTURBO
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- DE
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- Straßburger Str. 55 Berlin 10405 DE
- Website
- Visit
Screenshots & videos
Install growth
- 3 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
3 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Resmi Fenerbahçe SK Anasayfa uygulaması ile takımınızı destekleyin ve sizin için özelleştirilmiş bir tarayıcı deneyimine sahip olun.
Read the publisher’s full description
İnternet tarayıcınız için resmi Fenerbahçe SK Anasayfa uygulaması. Özel içerikler, en yeni duvar kağıtları ve Fenerbahçe hakkında en sıcak gelişmeler kişiselleştirilmiş Fenerbahçe SK tarayıcınızda. Hemen Fenerbahçe SK Chrome uygulamasını Windows ve Mac OS için indirin, her yeni sekme ile Fenerbahçe'yi destekleyin, ve gündemi tarayıcınızdan takip edin.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
3 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from brandTURBO
- Beşiktaş JK Anasayfa5,000 users
- Corinthians New Tab Startpage3,756 users
- Olympiacos FC1,823 users
- Wacken Open Air1,797 users
- Aston Villa1,434 users
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持88,000,000 users
- Passlit Openbook10,000,000 users
- Zotero Connector9,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users