Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Forest Start Tabs

CRITICAL RISKRemoved from Chrome Web Store

Forest Start Tabs

ID: nakfbmfenboiabdkmjmpihjabpofkpph

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

2.5

Size

1.57 MB

Rating

3.7/5

Reviews

Users

40,000

Type

Extension

Updated

Feb 7, 2024

Publisher Contextual Analysis

Trusted

Author: bryceView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

365,889

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Forest Start Tabs - Visit The Woods Everyday

Forest Start Tabs transforms your Chrome browser's new tab page into a serene forest landscape, offering a peaceful backdrop to begin your daily online activities, whether it's work-related tasks or leisurely browsing. This extension is designed to provide a moment of tranquility with each new tab, setting a calming tone for your online experience. In addition to enhancing your browser's aesthetic, Forest Start Tabs improves web navigation by introducing an elegantly designed error page. This feature activates when you encounter non-existent websites or other web errors, ensuring that your browsing experience remains seamless. Integrated with errors.net and various search partners such as bing and yahoo, the extension includes a functional search bar within the error page, facilitating an easy continuation of your online exploration without interruption.

User Growth

Showing data from Jan 22, 2022 to Jan 21, 2023

Versions

-11.18%(-5,035 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 27 ratings

Average Rating

Current: 3.74 / 5.0+3.74

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium1

Low1

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3 Code review	5

Extension Version	Code Review Findings
1.3	5

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js3
js/tab.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	high	js/background.js (line 10)	Listens on webNavigation errors across all http/https URLs and, when DNS resolution fails, redirects the tab to foreststarttabs.com with the failed hostname appended as a query parameter (`?nx=<hostname>`). This hijac…	1.3
2	Tracking	high	js/tab.js (line 48)	Despite the variable being named `google`, the search form does not send queries to Google — it redirects all user searches to foreststarttabs.com with an `ext=forest` affiliate/tracking tag. This is classic search hi…	1.3
3	Unauthorized Data Collection	high	js/background.js (line 10)	The hostname of every failed navigation attempt across the entire web is sent via GET parameter to foreststarttabs.com, constituting unauthorized data collection of user browsing intent (typos, unreachable intranet ho…	1.3
4	Remote Code Loading	medium	manifest.json (line 17)	The manifest declares a malformed `oauth2` block with `<all urls>` scope and a CSP override permitting `unsafe-inline` and `unsafe eval` plus loading remote scripts from apis.google.com. While MV3 ignores most of this…	1.3
5	Tracking	low	js/background.js (line 2)	On install, the extension forcibly navigates the active tab to foreststarttabs.com/thankyou/, which enables install-attribution tracking and affiliate-revenue pings. Combined with the search and DNS-error redirects, t…	1.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/mozilla/webextension-polyfill	https://github.com/mozilla/webextension-polyfill
mozilla.org	/MPL/2.0/	http://mozilla.org/MPL/2.0/.
facebook.com	-	https://facebook.com
twitter.com	-	https://twitter.com
www.instagram.com	-	https://www.instagram.com
www.tumblr.com	-	https://www.tumblr.com
foreststarttabs.com	-	https://foreststarttabs.com/?a=about
foreststarttabs.com	-	https://foreststarttabs.com/?a=privacy
foreststarttabs.com	-	https://foreststarttabs.com/?a=terms
foreststarttabs.com	-	https://foreststarttabs.com/?a=about/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

This is simple to do and has no negative impact on my computer. The advertisements aren't a problem, and I'm happy to do my small part to help the world.

Valerie Brady·5 Aug 2022

It was so simple to use that it made no difference in my daily life. I also like seeing how many I open in a day.

Abel Jerez·2 Aug 2022

It's amazing how simple it is to contribute to worthy causes by simply opening new tabs!

Anthony Brandin·19 Jun 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Forest Start Tabs

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating